0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112939 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112939 Source advisory: OSV:GHSA-RFPC-QCW5-3PC4...

GHSA-RFPC-QCW5-3PC4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5947 more potentially affected by CVE-2026-112939 via filelock (>=3.24.1, <=4.2.0)

filelock PYPI version =3.24.1, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112939 Source advisory: GHSA-RFPC-QCW5-3PC4...

EUVD-2026-105029

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker...

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who...

EUVD-2026-105019

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5859 more potentially affected by CVE-2026-112912 via filelock (>=3.32.6, <=4.2.0)

filelock PYPI version =3.32.6, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112912 Source advisory: GHSA-9J6Q-WVJ5-JGJG...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0xpwn (0.1.0) +5859 more potentially affected by CVE-2026-112912 via filelock (>=3.32.6, <=4.2.0)

filelock PYPI version =3.32.6, =0.2.0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.4.2 - a13n-claw 0.1.0 and more Source cves: CVE-2026-112912 Source advisory: OSV:GHSA-9J6Q-WVJ5-JGJG...

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

raiseonnotwritablefile is the check that SoftFileLock and the locks sharing its acquire path run before every attempt. It looks at the lock path with os.lstat, so that it judges a planted symlink a file that points at another path by itself. When the node has no owner-write bit, it then calls...

GHSA-9J6Q-WVJ5-JGJG filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

raiseonnotwritablefile is the check that SoftFileLock and the locks sharing its acquire path run before every attempt. It looks at the lock path with os.lstat, so that it judges a planted symlink a file that points at another path by itself. When the node has no owner-write bit, it then calls...

GHSA-69HJ-F68J-2879 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

UnixFileLock, the backend of FileLock and AsyncFileLock on Unix, empties whatever regular file it finds at the lock path once it holds the flock a kernel lock on an open file. With an explicit mode it also chmods that file sets its permission bits, whether or not this acquire created it. Another...

bili-stalker-mcp (>=3.3.0, <=3.5.0), deepagents-code (>=0.1.41, <=0.2.1) +8 more potentially affected by CVE-2026-112909 via filelock (3.29.7)

filelock PYPI version 3.29.7 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - bili-stalker-mcp =3.3.0, =0.1.41, =0.0.1, =0.1.0a1, =0.21.0, =1.0.0, =1.0.4 - weblate 2026.7.1 Source cves: CVE-2026-112909 Source advisory:...

ac-solver (0.1.0), admetica (>=1.3.0, <=1.4.1) +61 more potentially affected by CVE-2026-112909 via filelock (3.15.4)

filelock PYPI version 3.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - ac-solver 0.1.0 - admetica =1.3.0, =0.2.3, =2024.7.4, =0.1.0, =2.4.3b1, =2.0.0, =3.0.0rc14, =0.1.2, =0.1.0, =0.1.7 and more Source cves:...

aqua-core (1.0.0a4), ironoc-pytest-conor-heffron (2.3.3) +2 more potentially affected by CVE-2026-112909 via filelock (3.24.3)

filelock PYPI version 3.24.3 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - aqua-core 1.0.0a4 - ironoc-pytest-conor-heffron 2.3.3 - opentargets-otter =26.0.1, =1.7.1, =1.8.0 Source cves: CVE-2026-112909 Source advisory:...

ai2-tango (>=0.9.0, <=0.11.0), aitoolbox (>=1.0.0, <=1.1.0) +48 more potentially affected by CVE-2026-112909 via filelock (3.7.1)

filelock PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - ai2-tango =0.9.0, =1.0.0, =0.1.0, =2.10.0, =0.1.0, =0.0.3, =2.10.0, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.2, =0.1.0, =0.1.1 and more Source cves:...

babyvec (0.2.1), dnn-tts-torch (>=0.0.2, <=0.0.9) +2 more potentially affected by CVE-2026-112909 via filelock (3.15.3)

filelock PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - babyvec 0.2.1 - dnn-tts-torch =0.0.2, =0.5.0, =0.7.0 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...

afipcaeqrdecode (0.0.15), amzn-project-c-dock-app (1.1.0) +28 more potentially affected by CVE-2026-112909 via filelock (3.14.0)

filelock PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - afipcaeqrdecode 0.0.15 - amzn-project-c-dock-app 1.1.0 - autobiasdetector 0.0.2 - big-graph-dataset =0.0.1, =2.4.0rc1, =2.4.0, =0.1.4, =0.0.2,...

abaco (0.1.0), actscene-ocr (>=0.1.3, <=0.1.5) +92 more potentially affected by CVE-2026-112909 via filelock (3.18.0)

filelock PYPI version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - abaco 0.1.0 - actscene-ocr =0.1.3, =0.2.0, =0.87.2.dev9, =0.77.1, =0.1.0.dev19, =0.1.0, =0.0.1, =0.1.0, =0.1.2, =0.1.1, =0.1.2, =0.1.7, =0.2.0...

collabi (>=0.1.0, <=0.1.9), mycloud-cli (>=1.2.1, <=1.2.3) +1 more potentially affected by CVE-2026-112909 via filelock (3.0.4)

filelock PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - collabi =0.1.0, =1.2.1, =0.4.0, =0.8.0 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...

acpx-teams (>=0.1.0, <=0.7.0), claude-anyteam (>=0.3.0, <=0.8.4) +4 more potentially affected by CVE-2026-112909 via filelock (3.16.0)

filelock PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - acpx-teams =0.1.0, =0.3.0, =0.1.3, =0.1.1, =0.1.8 - lst-pressure 1.8.5 - prim-batch 0.1.0 Source cves: CVE-2026-112909 Source advisory:...