CVE-2026-112909 tox-dev CVE debrief

Who should care

Python developers and administrators using the filelock package should assess exposure and apply patches or mitigations as needed to prevent potential data loss or unauthorized changes. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review the 4.

Why it matters

CVE-2026-112909 is a medium-severity vulnerability in the filelock Python package that allows a local attacker with rename permission to truncate or modify a file. Python developers and administrators should assess exposure and apply patches or mitigations as needed to prevent potential data loss or unauthorized changes.

• Data loss or unauthorized changes due to file truncation or modification
• Potential disruption to system operations or data integrity
• Need for patching or mitigation to prevent exploitation

Technical summary

The filelock Python package is vulnerable to a medium-severity issue (CVE-2026-112909) that allows a local attacker with rename permission to truncate or modify a file. This issue is caused by a flaw in the UnixFileLock implementation and is fixed in version 4.2.1. The vulnerability has a CVSS score of 6.1 and a severity of MEDIUM. Affected product deployments should be assessed for exposure, and patches or mitigations should be applied as needed. The CVE record was published on 2026-10-20T15:17:15.313Z and has not been modified since then.

Defensive priority

Assess exposure and apply patches or mitigations as needed.

Recommended defensive actions

• Assess exposure to CVE-2026-112909 in Python environments using filelock versions prior to 4.2.1
• Apply patches or mitigations as needed
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a flaw in the UnixFileLock implementation, which can be exploited by a local attacker with rename permission. The issue is fixed in version 4.2.1 of the filelock package.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.