CVE-2026-112937: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in tox-dev filelock

The tox-dev filelock Python package versions from 4.1.0 up to but not including 4.2.1 contain a time-of-check to time-of-use (TOCTOU) race condition in the ReadWriteLock cleanup process. Specifically, the cleanup removes a randomized .filelock-* private-hard-link directory, which can be exploited by a local user who has rename permissions in a non-sticky parent directory. This user can observe a live lock name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion, potentially disrupting file lock integrity. The vulnerability is addressed in version 4.2.1.

The vulnerability allows a local attacker with rename access in a non-sticky parent directory to interfere with the file locking mechanism by manipulating lock directories. This can lead to unauthorized deletion or renaming of lock directories, impacting the integrity of file locks. The CVSS score of 6.1 reflects a medium severity with no confidentiality impact, but high integrity impact and low availability impact.

Upgrade tox-dev filelock to version 4.2.1 or later, where this TOCTOU race condition vulnerability is fixed. No other mitigation is indicated or required according to the available data.