Threats tagged 'brew-mlx-lm-cve-2026-112908'

The filelock library versions 3.30.0 through 4.2.0 have a vulnerability in the StrictSoftFileLock and AsyncStrictSoftFileLock classes where claim directories are created without applying the specified restrictive mode, resulting in directories that may be writable by other local users depending on the umask or default ACL settings. This allows another local user with write permissions on the claim directory to unlink the lock claim files, causing the lock to be incorrectly released and enabling concurrent holders to write protected data without detection. The vulnerability requires a local attacker with low privileges and a permissive environment configuration. The issue is fixed in version 0.32.2_1 of the affected product mlx-lm.