Threats tagged 'brew-virtualenvwrapper-cve-2026-112912'

A symlink swap race condition in the SoftFileLock implementation allows a local user with write access to the lock directory to leak one bit of information about whether a path exists and is writable by the lock user. This occurs because the writability check follows symlinks after an lstat call, enabling a time-of-check to time-of-use (TOCTOU) leak. The vulnerability affects filelock versions 3.32.6 through 4.2.0 and is mitigated on Linux by the fs.protected_symlinks kernel setting in sticky world-writable directories like /tmp. The impact is limited to leaking existence and writability of a chosen path, with no integrity or availability effects. The vulnerability is rated low severity with a CVSS score of 2.5 due to high attack complexity and limited information leakage.