Threats tagged 'brew-hatch-cve-2026-112940'

A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permissions in the directory containing the lock database to exploit SQLite's behavior of reopening lock files by name, following symlinks and acting on side files like -journal, -wal, and -shm. This can lead to the attacker writing arbitrary data into the lock user's files, creating or unlinking files, or causing lock acquisition failures. The issue affects filelock versions 3.20.4 through 4.2.0, with fixes available in version 1.18.1_2. The vulnerability requires specific directory permissions (non-sticky, writable by the attacker) and local access. It has a CVSS 3.1 score of 7.1 (High) with no confidentiality impact but high integrity and availability impacts.