618 matches found
seleniumbase (2.4.14) potentially affected by CVE-2026-112909 via filelock (3.5.0)
filelock PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - seleniumbase 2.4.14 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...
bfcl-eval (>=2025.11.10, <=2026.3.23), ironoc-pytest-conor-heffron (>=2.1.7, <=2.2.5) +37 more potentially affected by CVE-2026-112909 via filelock (3.20.0)
filelock PYPI version 3.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - bfcl-eval =2025.11.10, =2.1.7, =2.2.5 - isaacsim-asset 6.0.0.0 - isaacsim-benchmark 6.0.0.0 - isaacsim-core 6.0.0.0 - isaacsim-cortex 6.0.0.0 -...
docling-pipelines (>=2.0.0, <=2.0.1), kolega-code (>=0.41.3, <=0.45.1) +1 more potentially affected by CVE-2026-112909 via filelock (3.24.2)
filelock PYPI version 3.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - docling-pipelines =2.0.0, =0.41.3, =0.45.1 - opentargets-otter 26.0.0 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...
bandersnatch (>=3.0.0, <=3.0.1) potentially affected by CVE-2026-112909 via filelock (3.0.9)
filelock PYPI version 3.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - bandersnatch =3.0.0, =3.0.1 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...
apollo-sdk (>=0.2.0, <=0.2.11), autorad (>=0.2.5.dev0, <=0.2.5) +17 more potentially affected by CVE-2026-112909 via filelock (3.8.0)
filelock PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - apollo-sdk =0.2.0, =0.2.5.dev0, =0.12.0.dev48, =0.0.3, =0.2.11, =0.0.31, =1.8.0, =1.0.0, =1.8.0, =2.4.0rc2 - rooster-client 0.0.1 and more Sourc...
ironoc-pytest-conor-heffron (>=2.3.4, <=2.3.5), memory-os-ai (>=4.0.6, <=4.0.8) +3 more potentially affected by CVE-2026-112909 via filelock (3.25.0)
filelock PYPI version 3.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - ironoc-pytest-conor-heffron =2.3.4, =4.0.6, =0.3.1, =0.23.1, =1.0.0, =1.2.2 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-28...
0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112936 via filelock (>=3.20.4, <=4.0.8)
filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112936 Source advisory: OSV:GHSA-J8F7-RJXC-MR56...
0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112936 via filelock (>=3.20.4, <=4.0.8)
filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112936 Source advisory: GHSA-J8F7-RJXC-MR56...
EUVD-2026-105026
filelock: ReadWriteLock follows a symlink at the lock path into SQLite...
GHSA-J8F7-RJXC-MR56 filelock: ReadWriteLock follows a symlink at the lock path into SQLite
Summary ReadWriteLock and AsyncReadWriteLock resolve the lock path with pathlib.Path.resolve and pass it to sqlite3.connect without refusing a symlink. A local user who can create names in the lock's directory, such as /tmp or a shared cache, can plant a symlink at the lock path and make the...
0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112938 via filelock (>=3.30.3, <=4.2.0)
filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112938 Source advisory: SNYK:PYTHON-FILELOCK-21802520...
GHSA-M462-7RXW-WVPG filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
StrictSoftFileLock and AsyncStrictSoftFileLock check .filelock the coordination directory that holds the lock's state with one lstat call on its name. lstat reports what a name is without following a symbolic link a file that redirects to another path. After that check, the code reaches...
0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112938 via filelock (>=3.30.3, <=4.2.0)
filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112938 Source advisory: OSV:GHSA-M462-7RXW-WVPG...
0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112938 via filelock (>=3.30.3, <=4.2.0)
filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112938 Source advisory: GHSA-M462-7RXW-WVPG...
Race Condition Enabling Link Following
Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via the strict lock's claim directory creation in strict.py, where the directory used to hold lock claims is not kept private to the lock owner. An attacker with write access to the parent director...
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
StrictSoftFileLock and AsyncStrictSoftFileLock check .filelock the coordination directory that holds the lock's state with one lstat call on its name. lstat reports what a name is without following a symbolic link a file that redirects to another path. After that check, the code reaches...
atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112934 via filelock (>=4.0.0, <=4.2.0)
filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112934 Source advisory: OSV:GHSA-FJ95-FR6C-H845...
atsfill (>=0.0.4.dev96, <=0.0.8.dev229), displayrws (>=0.1.3, <=0.1.4) +16 more potentially affected by CVE-2026-112934 via filelock (>=4.0.0, <=4.2.0)
filelock PYPI version =4.0.0, =0.0.4.dev96, =0.1.3, =5.4.2, =2026.10.0b1, =0.10.43, =0.10.43, =7.48.17, =0.10.43, =1.2.7, =0.2.1, =0.3.0, =2.2.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-112934 Source advisory: GHSA-FJ95-FR6C-H845...
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one refreshes its holder record the file under .rw/holders/ that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so by...