Threats tagged 'brew-virtualenvwrapper-cve-2026-112940'

The filelock ReadWriteLock and AsyncReadWriteLock components use SQLite databases for locking, but on Linux, SQLite reopens the lock database by name following symlinks and acting on side files like -journal, -wal, and -shm. This behavior allows a local attacker who can create or rename files in the directory holding the lock database (if it is writable without the sticky bit) to cause the lock user to write arbitrary data into their own files, create or unlink files, or disrupt locking operations. The vulnerability affects filelock versions 3.20.4 through 4.2.0, with fixes starting in 6.1.1_4 for virtualenvwrapper. The CVSS 3.1 score is 7.1 (High), reflecting local attack with low complexity and high integrity and availability impact but no confidentiality impact.