PyPI: filelock
CVE-2026-112934
Safety vulnerability ID: SFTY-20261020-78849
Affected versions of the `filelock` package are vulnerable to UNIX Hard Link due to refreshing holder records by name without verifying the file the name now resolves to. `SoftReadWriteLock` refreshes its holder records by path, so a record replaced between refreshes is opened and written without any check on what the name points to. A local attacker with rename access to the lock directory can substitute a named pipe to stall the lock or, under a permissive hard link policy, link a reachable target file so that the lock user writes through it.
Overview
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
Advisory
filelock – UNIX Hard Link
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20261020-78849/CVE-2026-112934
- https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845
- https://nvd.nist.gov/vuln/detail/CVE-2026-112934
- https://github.com/tox-dev/filelock/pull/842
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/advisories/GHSA-fj95-fr6c-h845
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more