Threats tagged 'brew-scrapy-cve-2026-112909'

The UnixFileLock component in the FileLock and AsyncFileLock implementations on Unix truncates and changes permissions of any regular file that another local user renames or hard-links onto the lock path before the lock user's next acquire. This can lead to unintended file truncation and permission changes, allowing the other user to read and modify the file contents thereafter. The vulnerability affects all filelock releases up to and including 4.2.0, with the chmod behavior introduced since version 3.10.2. Exploitation requires local access and specific directory permissions or kernel settings. The issue is fixed in filelock version 2.19.0_2.