Threats affecting pkg:brew/rapid-mlx

CVE-2026-112940 is a vulnerability in the ReadWriteLock and AsyncReadWriteLock components of the filelock library (versions >=0.10.12 <0.16.10) that use SQLite for locking. On Linux systems with /proc mounted, SQLite reopens lock database files by name, following symlinks and acting on side files (-journal, -wal, -shm). A local attacker who can create or rename files in the directory holding the lock database (if it is writable without the sticky bit) can cause the lock user to write arbitrary data into their own files, create or unlink files, or cause lock acquisition failures. The vulnerability requires local access and specific directory permissions but can lead to high integrity and availability impacts. A fix is available in version 0.16.10.