Threats tagged 'brew-lexicon-cve-2025-68146'

CVE-2025-68146 is a TOCTOU race condition vulnerability in the filelock library affecting Unix, Linux, macOS, and Windows. It allows local attackers with filesystem access to exploit a timing window between checking for a lock file's existence and opening it with truncation flags. By creating a symlink during this window, attackers can cause arbitrary user files to be truncated. This impacts dependent software such as virtualenv, PyTorch, poetry, and tox. The issue is fixed in filelock version 3.20.1 by preventing symlink following during lock file creation.