Threats tagged 'brew-pipx-cve-2026-112914'

A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local unprivileged user to exploit a race condition in the soft-lock stale break restore process. This occurs when the user can write to a shared lock directory without the sticky bit, replacing a lock file marker with a symbolic link. The lock user's process then creates a hard link to one of its own files via the symbolic link, exposing file metadata and allowing the other user to manipulate the file's name. On version 4.2.0, this can lead to truncation of the lock user's file. The vulnerability requires specific conditions including a writable non-sticky directory and CPython 3.12 or later on Linux or macOS. The CVSS 3.1 score is 5.3 (Medium). A fix is available in version 1.18.4 for the related product pipx.