File Lock Vulnerability in Python Library by Tox-Dev
CVE-2026-112939

4.7MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112939?

The filelock library, a platform-independent file locking solution for Python, is susceptible to a vulnerability that allows an unauthorized process to manipulate a forged process identifier. This manipulation can lead to scenarios where an attacker gains the ability to remove live markers, granting unauthorized access or control over file operations. Users are strongly advised to upgrade to version 4.2.1 to mitigate this issue and ensure system integrity.

Affected Version(s)

filelock >= 3.22.0, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/836
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/eeceaa846cbe4d...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.