Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the lock file open logic in api.py and related platform backends, where an existing lock file's permissions are not preserved on Unix systems. An attacker with local access can observe the file mode applied to a newly...