Threats tagged 'brew-virtualenvwrapper-cve-2026-112937'

A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local user with write permission on the directory holding the lock database to rename directories and cause the lock user's process to recursively delete arbitrary directories. This occurs because the ReadWriteLock and AsyncReadWriteLock implementations remove private .filelock-* link directories without verifying that the path still points to the originally created directory. The issue affects macOS since version 4.1.1 and POSIX environments without a usable /proc/self/fd, such as chroots or containers without /proc mounted. The vulnerability has a CVSS score of 6.1 (Medium) and results in high integrity impact by enabling deletion of directories owned by the lock user without error reporting.