Threats affecting pkg:brew/pipx

CVE-2026-112940 affects the filelock library's ReadWriteLock and AsyncReadWriteLock components that use SQLite for locking. On Linux systems with /proc mounted, SQLite reopens lock database files by name, following symlinks and acting on side files such as -journal, -wal, and -shm. A local attacker with write access to the directory containing the lock database can exploit this to cause the lock user to overwrite or unlink files with the lock user's privileges. This requires the directory to be writable without the sticky bit, such as a 0777 or group-writable directory without sticky bit. The vulnerability is present in filelock versions 3.20.4 through 4.2.0, with the /proc/self/fd redirect introduced in 4.0.9 and side-file variants since 3.20.4. The issue can cause high integrity and availability impact but no confidentiality loss. A fix is available in version 1.18.4 of the affected product pipx.

filelock versions 4.1.0 through 4.2.0 contain a vulnerability in their ReadWriteLock and AsyncReadWriteLock implementations where private .filelock-* directories are deleted recursively without verifying the directory's identity. This can be exploited by a local user who can rename directories in the shared parent directory (without sticky bit protection) to cause the lock user's process to delete arbitrary directories with the lock user's permissions. The issue affects macOS since 4.1.1 and POSIX environments without a usable /proc/self/fd, such as chroots or containers without /proc. The vulnerability has a CVSS 3.1 score of 6.1 (Medium) and is fixed in filelock version 4.2.1.

A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local unprivileged user to exploit a race condition in the soft-lock stale break restore process. This occurs when the user can write to a shared lock directory without the sticky bit, replacing a lock file marker with a symbolic link. The lock user's process then creates a hard link to one of its own files via the symbolic link, exposing file metadata and allowing the other user to manipulate the file's name. On version 4.2.0, this can lead to truncation of the lock user's file. The vulnerability requires specific conditions including a writable non-sticky directory and CPython 3.12 or later on Linux or macOS. The CVSS 3.1 score is 5.3 (Medium). A fix is available in version 1.18.4 for the related product pipx.

A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local unprivileged user to cause a lock file eviction by exploiting inode reuse and coarse clock timestamp manipulation on ext4 or overlayfs filesystems. This results in two processes of the lock owner entering a critical section simultaneously, causing a high integrity impact without affecting confidentiality or availability.