atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112937 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112937 Source advisory: GHSA-JQC4-5CVW-7W85...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112937 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112937 Source advisory: OSV:GHSA-JQC4-5CVW-7W85...

EUVD-2026-105028

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory name...

GHSA-JQC4-5CVW-7W85 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112913 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112913 Source advisory: OSV:GHSA-9VHV-JXWW-XFM5...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112913 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112913 Source advisory: GHSA-9VHV-JXWW-XFM5...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via SQLite side-file handling in readwrite.py on Windows, where a local attacker can plant adversarial -wal or -journal side files adjacent to the lock database in a shared directory such ...

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

GHSA-9VHV-JXWW-XFM5 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112913 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112913 Source advisory: SNYK:PYTHON-FILELOCK-21689161...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112907 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112907 Source advisory: OSV:GHSA-567Q-5QVW-PF92...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112907 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112907 Source advisory: SNYK:PYTHON-FILELOCK-21689162...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112907 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112907 Source advisory: GHSA-567Q-5QVW-PF92...

GHSA-567Q-5QVW-PF92 filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

EUVD-2026-105015

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112906 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112906 Source advisory: GHSA-2G95-WG33-C5X2...

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112914 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112914 Source advisory: GHSA-CRV4-6MHJ-J5JH...