Threats tagged 'brew-pipx-cve-2026-112937'

filelock versions 4.1.0 through 4.2.0 contain a vulnerability in their ReadWriteLock and AsyncReadWriteLock implementations where private .filelock-* directories are deleted recursively without verifying the directory's identity. This can be exploited by a local user who can rename directories in the shared parent directory (without sticky bit protection) to cause the lock user's process to delete arbitrary directories with the lock user's permissions. The issue affects macOS since 4.1.1 and POSIX environments without a usable /proc/self/fd, such as chroots or containers without /proc. The vulnerability has a CVSS 3.1 score of 6.1 (Medium) and is fixed in filelock version 4.2.1.