Vulnerability in Tox-Dev Filelock
CVE-2026-112908
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.001 (1.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 1.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Tox-Dev Filelock — versions >= 3.30.0, < 4.2.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-112908?
- CVE-2026-112908 is a medium-severity vulnerability in Tox-Dev Filelock, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 5.3/10. Published 2026-11-05.
- How severe is CVE-2026-112908?
- Medium severity. CVSS v3 base score is 5.3 out of 10.