0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112935 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112935 Source advisory: SNYK:PYTHON-FILELOCK-21280755...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the stale-lock-breaking logic in trybreakexpiredlock and trybreakstalelock, where a race condition allows an attacker with write access to the lock directory to replace a held lock fil...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112936 via filelock (>=3.20.4, <=4.0.8)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112936 Source advisory: SNYK:PYTHON-FILELOCK-21280754...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ReadWriteLock in src/filelock/readwrite.py, which resolves the lock file path using Path.resolve before passing it to sqlite3.connect. An attacker who can plant a symlink in a shared lock directory can cause the victi...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via the read-write lock implementation in src/filelock/readwrite.py, where the SQLite lock database is opened using a shared, predictable name in a directory where another user can manipulate names...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112940 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112940 Source advisory: SNYK:PYTHON-FILELOCK-21280753...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112937 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112937 Source advisory: SNYK:PYTHON-FILELOCK-21280752...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via ReadWriteLock cleanup logic in readwrite.py, which removes a randomized .filelock- private hard-link directory during sweep operations. A local attacker with rename access in a...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112941 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112941 Source advisory: SNYK:PYTHON-FILELOCK-21280751...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the strict lock implementation in strict.py and related soft read-write storage code, where claim directories are created without being restricted to the owning account. A local attack...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112939 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112939 Source advisory: SNYK:PYTHON-FILELOCK-21280760...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via ownerisstale in src/filelock/soft.py and src/filelock/identity.py, when a process owner identity comparison is performed between a lock holder whose start token was recorded without a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the SQLite-backed read-write lock implementation in src/filelock/readwrite.py, where an untrusted actor who controls the database file path can supply a malformed or adversarial...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112915 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112915 Source advisory: SNYK:PYTHON-FILELOCK-21280750...

Use of Multiple Resources with Duplicate Identifier

Overview Affected versions of this package are vulnerable to Use of Multiple Resources with Duplicate Identifier via trybreakexpiredlock and trybreakstalelock in api.py and lease.py, where an attacker with write access to the lock directory can replace a held lock file with a symlink pointing at ...

atsfill (>=0.0.4.dev96, <=0.0.8.dev229), gam7 (7.50.0) +2 more potentially affected by CVE-2026-112906 via filelock (>=4.1.1, <=4.2.0)

filelock PYPI version =4.1.1, =0.0.4.dev96, =0.2.1, =0.2.2 Source cves: CVE-2026-112906 Source advisory: SNYK:PYTHON-FILELOCK-21280749...

DEBIAN-CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...

DEBIAN-CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112940

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a...

CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...