CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-112939

The filelock Python library is vulnerable to a flaw in SoftFileLock between versions 3.22.0 and 4.2.1. The root cause is that the component trusts a forged process identifier (PID) within a writable marker. This allows an authorized contender—such as another process under the same account or a ro...