These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the filelock library allows a local user to delete arbitrary directories by renaming a directory onto the .filelock-* link directory name. This occurs on the hard-link route, affecting macOS since 4.1.1 and POSIX processes without a usable /proc/self/fd. Affected versions include 4.1.0, 4.1.1, 4.1.2, and 4.2.0, with a fix in version 4.2.1.
A local user can create side files beside a SQLite database used by `ReadWriteLock` and `AsyncReadWriteLock` in the filelock package on Windows, causing a denial of service for other local users. The issue arises because SQLite acts on these side files before acquiring the lock. This vulnerability allows an attacker to create a denial of service condition by placing a side file, such as a `-wal` or `-jour [truncated]
A local user can create a pre-dated file in a directory where a lock file is present, potentially leading to the eviction of the lock file and allowing the local user to gain access to resources protected by the lock. This vulnerability exists in the SoftFileLock and MarkerSoftFileLock classes of the filelock library. The classes evict an unparsable marker (the lock file) once a waiting contender has watc [truncated]
A local user can exploit a vulnerability in the filelock package to create a hard link to any of their own files on the same filesystem, potentially allowing them to access files inside directories they cannot enter. The vulnerability is caused by a soft-lock stale break restore issue in the filelock package. This issue allows a local user to create a hard link to any of their own files on the same filesy [truncated]
CVE-2026-112940 is a high-severity vulnerability in the filelock library, which affects local users who can create or rename entries in a directory. The vulnerability allows an attacker to make the lock user's process overwrite or unlink its own files. This vulnerability is particularly concerning because it can be exploited by creating or renaming entries in the directory holding the lock database, which [truncated]