Threats tagged 'brew-poetry-cve-2026-112934'

A vulnerability in filelock versions 4.0.0 through 4.2.0 allows a local user who owns the lock's .rw directory tree to interfere with the lock holder's refresh operations. By replacing the holder record with a FIFO (named pipe), the attacker can cause the lock holder's write or read lock operations to hang indefinitely, preventing heartbeat refreshes and allowing multiple processes to believe they hold the lock simultaneously. Additionally, on systems where the kernel permits hard links to files not owned by the user (e.g., Linux with fs.protected_hardlinks=0), the attacker can cause the lock holder to overwrite the first ~135 bytes of one of its own private files with lock holder data. The vulnerability has a CVSS score of 6.1 (Medium) and affects local users with low privileges but no confidentiality impact.