CVE-2025-68146

Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system.