TOCTOU Race Condition Vulnerability in File Locking for Python by Tox-Dev

CVE-2026-22701

What is CVE-2026-22701?

A TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package prior to version 3.20.3. This flaw allows an attacker with local filesystem access to exploit a timing issue between permission validation and file creation. By creating a symlink during the race window, it can cause the lock operations to fail or redirect operations to unintended target files, potentially leading to a denial of service. The vulnerability has been rectified in version 3.20.3.

References