Threats tagged 'brew-poetry-cve-2026-112939'

A vulnerability in filelock versions 3.22.0 through 4.2.0 allows a local user with write access to a lock marker file (but not removal rights) to forge the process ID in the marker. This causes the lock to be incorrectly considered stale, enabling two processes to simultaneously hold the lock and write to the protected resource without error. The issue arises when the marker file is group- or other-writable, typically due to permissive file modes or umask settings in sticky or restricted directories. The vulnerability has medium severity with a CVSS score of 4.7.