filelock

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.3

GHSA-6627-m3xw-93mpFix available

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.30.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-6627-m3xw-93mp

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.30.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium5.3

GHSA-8mx5-7m5m-r77gFix available

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.10.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-8mx5-7m5m-r77g

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.10.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.10.0",
    "3.10.1",
    "3.10.2",
    "3.10.3",
    "3.10.4",
    "3.10.5",
    "3.10.6",
    "3.10.7",
    "3.11.0",
    "3.12.0",
    "3.12.1",
    "3.12.2",
    "3.12.3",
    "3.12.4",
    "3.13.0",
    "3.13.1",
    "3.13.2",
    "3.13.3",
    "3.13.4",
    "3.14.0",
    "3.15.0",
    "3.15.1",
    "3.15.2",
    "3.15.3",
    "3.15.4",
    "3.16.0",
    "3.16.1",
    "3.17.0",
    "3.18.0",
    "3.19.1",
    "3.20.0",
    "3.20.1",
    "3.20.2",
    "3.20.3",
    "3.20.4",
    "3.21.0",
    "3.21.1",
    "3.21.2",
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium5.5

GHSA-cwqr-hh33-gh44Fix available

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.20.4 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-cwqr-hh33-gh44

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.20.4"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.20.4",
    "3.21.0",
    "3.21.1",
    "3.21.2",
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium4.7

GHSA-rfpc-qcw5-3pc4Fix available

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.22.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-rfpc-qcw5-3pc4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.22.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

low2.5

GHSA-9j6q-wvj5-jgjgFix available

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.32.6 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-9j6q-wvj5-jgjg

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.32.6"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium6.1

GHSA-69hj-f68j-2879Fix available

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
Earlier releases before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-69hj-f68j-2879

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.2.0",
    "0.2.1",
    "0.2.2",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "2.0.0",
    "2.0.1",
    "2.0.10",
    "2.0.11",
    "2.0.12",
    "2.0.13",
    "2.0.4",
    "2.0.5",
    "2.0.6",
    "2.0.7",
    "2.0.8",
    "2.0.9",
    "3.0.0",
    "3.0.10",
    "3.0.12",
    "3.0.2",
    "3.0.3",
    "3.0.4",
    "3.0.6",
    "3.0.8",
    "3.0.9",
    "3.1.0",
    "3.10.0",
    "3.10.1",
    "3.10.2",
    "3.10.3",
    "3.10.4",
    "3.10.5",
    "3.10.6",
    "3.10.7",
    "3.11.0",
    "3.12.0",
    "3.12.1",
    "3.12.2",
    "3.12.3",
    "3.12.4",
    "3.13.0",
    "3.13.1",
    "3.13.2",
    "3.13.3",
    "3.13.4",
    "3.14.0",
    "3.15.0",
    "3.15.1",
    "3.15.2",
    "3.15.3",
    "3.15.4",
    "3.16.0",
    "3.16.1",
    "3.17.0",
    "3.18.0",
    "3.19.1",
    "3.2.0",
    "3.2.1",
    "3.20.0",
    "3.20.1",
    "3.20.2",
    "3.20.3",
    "3.20.4",
    "3.21.0",
    "3.21.1",
    "3.21.2",
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.3.0",
    "3.3.1",
    "3.3.2",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "3.4.0",
    "3.4.1",
    "3.4.2",
    "3.5.0",
    "3.5.1",
    "3.6.0",
    "3.7.0",
    "3.7.1",
    "3.8.0",
    "3.8.1",
    "3.8.2",
    "3.9.0",
    "3.9.1",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium6.1

GHSA-j8f7-rjxc-mr56Fix available

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.20.4 before 4.0.9Ecosystem versions	4.0.9

Version evidence: OSV · GHSA-j8f7-rjxc-mr56

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.20.4"
        },
        {
          "fixed": "4.0.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.20.4",
    "3.21.0",
    "3.21.1",
    "3.21.2",
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8"
  ]
}

medium5.8

GHSA-m462-7rxw-wvpgFix available

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 3.30.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-m462-7rxw-wvpg

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.30.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium6.1

GHSA-fj95-fr6c-h845Fix available

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

PyPI / filelock

2 days ago

filelock PyPI

Affected range	Recorded fix
From 4.0.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-fj95-fr6c-h845

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

low3.3

CVE-2026-112941Fix available

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

PyPI / filelock

11 days ago

filelock PyPI

Affected range	Recorded fix
From 4.1.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-wfhq-q4j2-c37m

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.1.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium4.7

CVE-2026-112935Fix available

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

PyPI / filelock

11 days ago

filelock PyPI

Affected range	Recorded fix
From 3.22.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-fq56-3cx3-fjxp

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.22.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.22.0",
    "3.23.0",
    "3.24.0",
    "3.24.1",
    "3.24.2",
    "3.24.3",
    "3.25.0",
    "3.25.1",
    "3.25.2",
    "3.28.0",
    "3.29.0",
    "3.29.1",
    "3.29.2",
    "3.29.3",
    "3.29.4",
    "3.29.5",
    "3.29.6",
    "3.29.7",
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}

medium6.3

CVE-2026-112911Fix available

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

PyPI / filelock

11 days ago

filelock PyPI

Affected range	Recorded fix
From 3.30.0 before 4.2.1Ecosystem versions	4.2.1

Version evidence: OSV · GHSA-9c4x-gm8v-wgc4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.30.0"
        },
        {
          "fixed": "4.2.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.30.0",
    "3.30.1",
    "3.30.2",
    "3.30.3",
    "3.31.0",
    "3.31.1",
    "3.31.2",
    "3.32.0",
    "3.32.2",
    "3.32.3",
    "3.32.4",
    "3.32.5",
    "3.32.6",
    "3.32.7",
    "4.0.0",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.1",
    "4.1.2",
    "4.2.0"
  ]
}