Threats tagged 'brew-hatch-cve-2026-112937'

A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permission on the lock database's parent directory to rename directories and cause the lock user's process to recursively delete arbitrary directories. This occurs because the lock cleanup does not verify that the directory it deletes is still the originally created lock directory, enabling deletion of directories renamed onto the expected lock directory name. The issue affects filelock versions 4.1.0 through 4.2.0 on macOS and POSIX systems without a usable /proc/self/fd, such as containers or chroots without /proc. The vulnerability requires a non-sticky, writable shared parent directory and local user privileges. The CVSS 3.1 score is 6.1 (Medium).