{"id":"CVE-2026-112939","title":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","summary":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as anot…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-345"],"vendor":"tox-dev","product":"filelock","affected":["filelock >= 3.22.0, < 4.2.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:14:32.481979Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:14:56.836Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112939","references":[{"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4","label":"https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4"},{"url":"https://github.com/tox-dev/filelock/pull/836","label":"https://github.com/tox-dev/filelock/pull/836"},{"url":"https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc","label":"https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc"},{"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1","label":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-20T15:09:24.119Z","slug":"CVE-2026-112939","body":"## Overview\n\nfilelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.\n\n## Affected\n\n- `filelock >= 3.22.0, < 4.2.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":225972,"id":"CVE-2026-112939","ts":1792512743106,"field":"exploit_available","old":"false","new":"true"}]}