CVE-2026-112941: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in tox-dev filelock

The filelock library for Python, used for platform-independent file locking, contained a time-of-check to time-of-use (TOCTOU) race condition in the SoftReadWriteLock and AsyncSoftReadWriteLock classes from versions 4.1.0 up to but not including 4.2.1. These classes cache the result of a successful check on the <path>.rw lock tree and later resolve its names again during record operations. This caching allows a local attacker who can replace the lock tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This behavior could lead to unintended modification of files or directories. The issue is resolved in version 4.2.1.

The vulnerability allows a local user with the ability to replace the lock tree directory after initial acquisition to redirect lock-record writes into directories writable by the lock user. This can lead to integrity issues by enabling unauthorized modification of files or directories. The CVSS score of 3.3 reflects a low severity impact with limited scope and no confidentiality or availability impact.

Upgrade to tox-dev filelock version 4.2.1 or later, where this TOCTOU race condition has been fixed. No other mitigation is indicated or necessary as the fix is available.