0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112908 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112908 Source advisory: SNYK:PYTHON-FILELOCK-21802489...

GHSA-6627-M3XW-93MP filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

StrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel the lock file at and to both claim files the files whose presence says a process wants or holds the lock. They create the two directories that hold the claims, .filelock and .filelock/claims, with a bare mkdir...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112908 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112908 Source advisory: OSV:GHSA-6627-M3XW-93MP...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112908 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112908 Source advisory: GHSA-6627-M3XW-93MP...

GHSA-9C4X-GM8V-WGC4 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

StrictSoftFileLock, AsyncStrictSoftFileLock, SoftReadWriteLock and AsyncSoftReadWriteLock keep their whole ownership state as files in a directory derived from the lock path .filelock/claims, .rw/gen,holders. When that directory already exists they adopt it after checking only that it is a real...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112911 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112911 Source advisory: GHSA-9C4X-GM8V-WGC4...

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

StrictSoftFileLock, AsyncStrictSoftFileLock, SoftReadWriteLock and AsyncSoftReadWriteLock keep their whole ownership state as files in a directory derived from the lock path .filelock/claims, .rw/gen,holders. When that directory already exists they adopt it after checking only that it is a real...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5873 more potentially affected by CVE-2026-112911 via filelock (>=3.30.3, <=4.2.0)

filelock PYPI version =3.30.3, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112911 Source advisory: OSV:GHSA-9C4X-GM8V-WGC4...

EUVD-2026-105018

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +6518 more potentially affected by CVE-2026-112910 via filelock (>=3.10.0, <=4.2.0)

filelock PYPI version =3.10.0, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112910 Source advisory: OSV:GHSA-8MX5-7M5M-R77G...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +6518 more potentially affected by CVE-2026-112910 via filelock (>=3.10.0, <=4.2.0)

filelock PYPI version =3.10.0, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112910 Source advisory: GHSA-8MX5-7M5M-R77G...

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock on Windows ignores the mode argument. FileLockpath, mode=0o600 creates the same file as FileLockpath: one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files. filelock...

GHSA-8MX5-7M5M-R77G filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock on Windows ignores the mode argument. FileLockpath, mode=0o600 creates the same file as FileLockpath: one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files. filelock...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +6518 more potentially affected by CVE-2026-112910 via filelock (>=3.10.0, <=4.2.0)

filelock PYPI version =3.10.0, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112910 Source advisory: SNYK:PYTHON-FILELOCK-21802490...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the Windows file lock backend WindowsFileLock, which ignores the mode parameter when creating lock files. An attacker with local access can observe or interfere with lock files...

GHSA-CWQR-HH33-GH44 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock run PRAGMA journalmode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema the sqlitemaster table, which lists every table and index with its CREATE text of whatever file sits a...

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock run PRAGMA journalmode=MEMORY on a fresh connection for every acquire. That statement makes SQLite load the whole schema the sqlitemaster table, which lists every table and index with its CREATE text of whatever file sits a...

EUVD-2026-105021

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112915 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112915 Source advisory: OSV:GHSA-CWQR-HH33-GH44...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5953 more potentially affected by CVE-2026-112915 via filelock (>=3.20.4, <=4.2.0)

filelock PYPI version =3.20.4, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112915 Source advisory: GHSA-CWQR-HH33-GH44...