Threats tagged 'brew-scrapy-cve-2026-112908'

The filelock library versions from 3.30.0 up to 4.2.0 have a vulnerability in StrictSoftFileLock and AsyncStrictSoftFileLock where claim directories are created without applying the intended restrictive mode, allowing other local users with write permissions on these directories to unlink claim files. This can lead to multiple holders simultaneously writing protected data without detection. The vulnerability requires a local attacker with write access to the lock's claim directories, which depends on the environment's umask or default ACL settings. The issue is fixed in version 2.19.0_2 of the affected product.