CVE-2026-112940: CWE-363: Race Condition Enabling Link Following in tox-dev filelock

The filelock package for Python, used for platform-independent file locking, contains a race condition vulnerability in its ReadWriteLock implementation affecting versions >=3.20.4 and <4.2.1. On POSIX systems, an attacker with rename privileges in a non-sticky parent directory can exploit this condition to swap SQLite database and side file names, leading to overwrite or unlink operations. Additionally, a writable adjacent hot journal file is required for the attacker to overwrite content of their choosing. This vulnerability is classified under CWE-363 (Race Condition) and has a CVSS 3.1 base score of 7.1, indicating high severity. The vulnerability was fixed in version 4.2.1 of filelock.

An attacker with limited privileges (rename access in a non-sticky parent directory) can exploit this race condition to cause integrity violations by overwriting or unlinking SQLite database files or side files. This can lead to denial of service or data corruption. The vulnerability does not impact confidentiality but affects integrity and availability, as reflected in the CVSS vector (C:N/I:H/A:H). No known exploits are reported in the wild.

Upgrade the filelock package to version 4.2.1 or later, where this race condition vulnerability has been fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 4.2.1.