Threats tagged 'brew-shodan-cve-2025-68146'

CVE-2025-68146 is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the filelock library affecting Unix, Linux, macOS, and Windows. It allows local attackers with filesystem access and symlink creation ability to exploit a race window during lock file creation, causing arbitrary user files to be truncated or corrupted via symlink attacks. This impacts dependent software such as virtualenv, PyTorch, poetry, and tox. The vulnerability is fixed in filelock version 3.20.1 by preventing symlink following during file open operations.