Threats tagged 'brew-scrapy-cve-2026-112911'

A vulnerability in filelock's StrictSoftFileLock and SoftReadWriteLock classes allows a local unprivileged user to pre-create the lock protocol directory in a shared sticky directory (e.g., /tmp). This causes the lock implementation to adopt a directory owned by the attacker, enabling them to interfere with lock claims and cause multiple processes to enter critical sections simultaneously. The flaw affects filelock versions 3.30.0 through 4.2.0 and can lead to integrity and availability impacts, such as concurrent writes and denial of service via spinning or memory exhaustion. The vulnerability requires the attacker to race the legitimate user by creating the directory first on a new or cleaned lock path. A fix is available in version 2.19.0_2 of the affected product scrapy.