Tox-dev Filelock vulnerabilities

• tox-dev filelock filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold CVE-2026-112908 Fix available 5.3 MediumOctober 28, 2026
• tox-dev filelock filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL CVE-2026-112910 Fix available 5.3 MediumOctober 28, 2026
• tox-dev filelock filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses CVE-2026-112938 Fix available 5.8 MediumOctober 28, 2026
• tox-dev filelock filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database CVE-2026-112913 Fix available 3.3 LowOctober 23, 2026
• tox-dev filelock filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break CVE-2026-112907 Fix available 2.5 LowOctober 23, 2026
• tox-dev filelock filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock CVE-2026-112941 Fix available 3.3 LowOctober 20, 2026
• tox-dev filelock filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files CVE-2026-112940 Fix available 7.1 HighOctober 20, 2026
• tox-dev filelock filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker CVE-2026-112939 Fix available 4.7 MediumOctober 20, 2026
• tox-dev filelock filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name CVE-2026-112937 Fix available 6.1 MediumOctober 20, 2026
• tox-dev filelock filelock: ReadWriteLock follows a symlink at the lock path into SQLite CVE-2026-112936 Fix available 6.1 MediumOctober 20, 2026
• tox-dev filelock filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders CVE-2026-112935 Fix available 4.7 MediumOctober 20, 2026
• tox-dev filelock filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record CVE-2026-112934 Fix available 6.1 MediumOctober 20, 2026
• tox-dev filelock filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout CVE-2026-112915 Fix available 5.5 MediumOctober 20, 2026
• tox-dev filelock filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory CVE-2026-112914 Fix available 5.3 MediumOctober 20, 2026
• tox-dev filelock filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker CVE-2026-112912 Fix available 2.5 LowOctober 20, 2026
• tox-dev filelock filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion CVE-2026-112911 Fix available 6.3 MediumOctober 20, 2026
• tox-dev filelock filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path CVE-2026-112909 Fix available 6.1 MediumOctober 20, 2026
• tox-dev filelock filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse CVE-2026-112906 Fix available 4.7 MediumOctober 20, 2026
• tox-dev filelock filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock CVE-2026-22701 Fix available 5.3 MediumJanuary 10, 2026
• tox-dev filelock filelock has TOCTOU race condition that allows symlink attacks during lock file creation CVE-2025-68146 Fix available 6.3 MediumDecember 16, 2025