PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112935 tox-dev CVE debrief

CVE-2026-112935 is a medium-severity vulnerability in the filelock Python package, allowing an attacker to bypass file locking under specific conditions. Affected versions range from 3.22.0 to 4.2.1. The issue is fixed in version 4.2.1. This vulnerability may lead to unintended access and impact system synchronization and security. Developers and administrators should assess their exposure and apply patches to prevent potential security risks. The vulnerability exists when an honest contender creates a live successor on the reused inode and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted

Vendor
tox-dev
Product
filelock
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-28
Advisory published
2026-10-20
Advisory updated
2026-10-28

Who should care

Developers and administrators using the filelock Python package should assess their exposure and apply patches. This vulnerability may impact systems relying on file locking for synchronization or security.

Why it matters

CVE-2026-112935 is a medium-severity vulnerability in the filelock Python package that allows an attacker to bypass file locking under specific conditions. Affected versions exist from 3.22.0 until 4.2.1. The issue is fixed in version 4.2.1. Developers and administrators should assess their exposure and apply patches to prevent potential unintended access and impacts on system synchronization and security.

  • Potential unintended access due to bypassed file locking
  • Need to verify and update affected systems
  • Possible impact on system synchronization and security

Technical summary

The filelock Python package has a vulnerability that allows an attacker to bypass file locking under specific conditions. This issue exists in versions from 3.22.0 until 4.2.1. An attacker can exploit this vulnerability when an honest contender creates a live successor on the reused inode and the successor's modification time is not newer than the saved observation. This can lead to the live marker being removed and two holders being admitted.

Defensive priority

Medium

Recommended defensive actions

  • Review and update filelock to version 4.2.1 or later
  • Assess exposure and apply patches
  • Monitor systems for potential exploitation attempts
  • Verify affected systems and apply patches
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The vulnerability exists in filelock versions from 3.22.0 until 4.2.1. An attacker can exploit this issue under specific conditions, including when an honest contender creates a live successor on the reused inode and the successor's modification time is not newer than the saved observation. This can lead to the live marker being removed and two holders being admitted.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112935 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112935

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112935 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112935

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.