Threats tagged 'brew-bbot-cve-2026-22701'

CVE-2026-22701 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in the SoftFileLock class of the filelock package used by the bbot product. The flaw allows a local attacker with permission to create symlinks to exploit a race window between permission checking and file creation, potentially causing lock acquisition to fail silently, leading to denial of service or unintended file operations. The vulnerability affects versions >=1.0.5.1665 and <2.7.2_5. A patch is available in version 2.7.2_5 that adds the O_NOFOLLOW flag to prevent symlink attacks on supported platforms. Users are advised to upgrade to the patched version or apply mitigations such as using alternative locking mechanisms or restricting filesystem permissions.