PatchTheCVECVE-2026-112934: filelock is a platform-independent file lock for Python
27
Routine
MEDIUM 6.1UPGRADE
CVE-2026-112934 is a medium-severity flaw (CVSS 6.1) affecting filelock. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-62 |
| Published | 2026-10-20 |
| Last modified | 2026-10-22 |
Publisher (CNA): GitHub, Inc. · Vendor: tox-dev
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
tox-dev filelock UPGRADE
Affected: >= 4.0.0 and < 4.2.1
Fixed in: 4.2.1
Safe to downgrade to: a release before 4.0.0
1. Check installed version
pip show filelock
2. UPGRADE to 4.2.1
pip install --upgrade "filelock>=4.2.1"
3. If no update is available yet, DOWNGRADE to a release before 4.0.0
pip index versions filelock
pip install "filelock<4.0.0"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-112940 HIGH 7.1 UPGRADE filelock is a platform-independent file lock for Python