Threats tagged 'brew-hf-cve-2026-112908'

The StrictSoftFileLock and AsyncStrictSoftFileLock classes in filelock versions 3.30.0 through 4.2.0 create claim directories with overly permissive permissions due to using bare mkdir() calls. This can allow other local users with write access to these directories to unlink claim files, causing multiple holders to believe they hold the lock simultaneously, leading to integrity issues. The vulnerability requires a specific environment where the umask or default ACL settings leave write permissions for other users on the lock's parent directory. The CVSS score is 5.3 (Medium), reflecting local attack complexity and high integrity impact but no confidentiality loss.