CVE-2026-112939: CWE-345: Insufficient Verification of Data Authenticity in tox-dev filelock

CVE-2026-112939 describes a weakness in tox-dev's filelock library, specifically in the SoftFileLock implementation between versions 3.22.0 and 4.2.0 inclusive. The flaw is due to insufficient verification of the authenticity of a process identifier stored in a marker file. An attacker with authorized access (e.g., another process running under the same user or root) can forge this identifier, remove the live marker, and thereby allow another process to acquire the lock improperly. This can lead to unauthorized lock acquisition and potential interference with file locking mechanisms. The issue is resolved in version 4.2.1.

The vulnerability allows an authorized contender process to bypass proper lock ownership verification by forging a process identifier in the lock marker. This can lead to unauthorized lock acquisition, potentially causing interference or race conditions in applications relying on filelock for synchronization. The impact is limited to integrity (I:H) with no confidentiality or availability impact reported. Exploitation requires local access with at least limited privileges and high attack complexity.

Upgrade to filelock version 4.2.1 or later, where this vulnerability is fixed. No other mitigations are specified or recommended by the vendor. Since this is a local privilege issue requiring authorized access, restricting local user permissions may reduce risk but does not fully mitigate the vulnerability.