tox-dev has 13 CVEs on record. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 13. The median CVSS is 5.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-367 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 13 prev 0
Worst active — by depth score
CVE-2026-112936Medium· 6.1filelock: ReadWriteLock follows a symlink at the lock path into SQLite46CVE-2026-112915Medium· 5.5filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout42CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files39CVE-2026-112939Medium· 4.7filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker38CVE-2026-112906Medium· 4.7filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse38
tox-dev vulnerabilities
CVEs affecting tox-dev, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are w…
CVE-2026-112909Medium· 6.1filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive ha…
CVE-2026-112911Medium· 6.3filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a s…
CVE-2026-112912Low· 2.5PoCfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another…
CVE-2026-112915Medium· 5.5PoCfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to m…
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap…
CVE-2026-112934Medium· 6.1filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pi…
CVE-2026-112935Medium· 4.7filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the …
CVE-2026-112936Medium· 6.1PoCfilelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing ano…
CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky…
CVE-2026-112939Medium· 4.7PoCfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as anot…
CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those …
CVE-2026-112941Low· 3.3filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations,…