https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:33:16 +0000 https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-22701 <p><strong>Affected:</strong> Homebrew: aider</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2026-22701 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-bi98027 <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Security vulnerability affects the kserve-storage-controller package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Security vulnerability affects the kserve-storage-controller package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bi98027 https://cve.radiocsirt.org/vuln/euvd-2026-265407 EUVD-2026-265407 https://cve.radiocsirt.org/vuln/euvd-2026-265407 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22701 <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.</p> <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22701 https://cve.radiocsirt.org/vuln/ghsa-qmgc-5h2g-mvrw <p><strong>Affected:</strong> PyPI: filelock</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> <p><strong>Affected:</strong> PyPI: filelock</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> https://cve.radiocsirt.org/vuln/ghsa-qmgc-5h2g-mvrw https://cve.radiocsirt.org/vuln/msrc_cve-2026-22701 msrc_CVE-2026-22701 https://cve.radiocsirt.org/vuln/msrc_cve-2026-22701 https://cve.radiocsirt.org/vuln/oesa-2026-1237 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: python-filelock</p> <p>This package contains a single module, which implements a platform independent file locking mechanism for Python. Security Fix(es):</p> <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: python-filelock</p> <p>This package contains a single module, which implements a platform independent file locking mechanism for Python. Security Fix(es):</p> <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.(CVE-2026-22701)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1237 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10043-1 <p>python311-filelock-3.20.3-1.1 on GA media</p> <p>python311-filelock-3.20.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10043-1 https://cve.radiocsirt.org/vuln/pysec-2026-1374 <p><strong>Affected:</strong> PyPI: filelock</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> <p><strong>Affected:</strong> PyPI: filelock</p> <p>## Vulnerability Summary</p> <p>**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock</p> <p>**Affected Component:** `filelock` package - `SoftFileLock` class **File:** `src/filelock/_soft.py` lines 17-27 **CWE:** CWE-362, CWE-367, CWE-59</p> <p>---</p> <p>## Description</p> <p>A TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.</p> <p>The vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.</p> <p>### Attack Scenario</p> <p>``` 1. Lock attempts to acquire on /tmp/app.lock 2. Permission validation passes 3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock 4. os.open() tries to create lock file 5. Lock operates on attacker-controlled target file or fails ```</p> <p>---</p> <p>## Impact</p> <p>_What kind of vulnerability is it? Who is impacted?_</p> <p>This is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.</p> <p>**Affected Users:** - Applications using `filelock.SoftFil…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1374 https://cve.radiocsirt.org/vuln/suse-su-2026:20216-1 <p>Security update for python-filelock</p> <p>Security update for python-filelock</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20216-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-22701 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-filelock, Ubuntu:Pro:22.04:LTS: python-filelock, Ubuntu:Pro:24.04:LTS: python-filelock, Ubuntu:25.10: python-filelock, Ubuntu:26.04:LTS: python-filelock</p> <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: python-filelock, Ubuntu:Pro:22.04:LTS: python-filelock, Ubuntu:Pro:24.04:LTS: python-filelock, Ubuntu:25.10: python-filelock, Ubuntu:26.04:LTS: python-filelock</p> <p>filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-22701