Is CVE-2026-112909 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112909 being exploited in the wild.

How severe is CVE-2026-112909?

Medium severity, with a CVSS score of 6.1, published 20 October 2026.

Which products and versions are affected?

filelock (PyPI) <= 4.2.0, ECOSYSTEM:introduced=0,fixed=4.2.1; Tox-Dev Filelock before 4.2.1; versions 3.10.2 and later affected by mode change issue.

How is CVE-2026-112909 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-112909?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112909: filelock UnixFileLock file truncation on rename

Q: Which products and versions are affected?

filelock (PyPI) <= 4.2.0, ECOSYSTEM:introduced=0,fixed=4.2.1; Tox-Dev Filelock before 4.2.1; versions 3.10.2 and later affected by mode change issue.

Q: Is there a fix for CVE-2026-112909?

Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Restrict write and rename permissions on lock directories to prevent unprivileged users from placing files at lock paths, or disable hard-link creation on the filesystem if your system policy allows. [{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-17"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-112909 · Severity: medium · CVSS 6.1 · Published 2026-10-20

filelock is a Python library that manages file-based locking across platforms. A flaw in UnixFileLock allows an attacker with local access to truncate or modify permissions on arbitrary files by renaming or hard-linking them onto the lock path, potentially causing data loss or privilege escalation in multi-user systems.

Technologies: filelock (PyPI), Tox-Dev Filelock. Vendors: PyPI, Tox-Dev.

Quick answers

Is CVE-2026-112909 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112909 being exploited in the wild.
How severe is CVE-2026-112909?: Medium severity, with a CVSS score of 6.1, published 20 October 2026.
Which products and versions are affected?: filelock (PyPI) <= 4.2.0, ECOSYSTEM:introduced=0,fixed=4.2.1; Tox-Dev Filelock before 4.2.1; versions 3.10.2 and later affected by mode change issue.
Is there a fix for CVE-2026-112909?: Yes. filelock (PyPI): upgrade to 4.2.1 or later. Until then: Restrict write and rename permissions on lock directories to prevent unprivileged users from placing files at lock paths, or disable hard-link creation on the filesystem if your system policy allows.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-17"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112909 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-112909?: Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

filelock (PyPI): upgrade to 4.2.1 or later
```
pip install "filelock>=4.2.1"
```

Restrict write and rename permissions on lock directories to prevent unprivileged users from placing files at lock paths, or disable hard-link creation on the filesystem if your system policy allows.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-20"},{"kind":"patched","at":"2026-10-17"}]

Technical details

UnixFileLock truncates files at the lock path without verifying it created them, and applies mode changes to files it does not own when another local user renames or hard-links a file onto that path. The vulnerability affects versions prior to 4.2.1 on Unix systems where an attacker has rename or hard-link capability. An attacker can cause silent data loss or unauthorized permission changes on target files.

Affected products

tox-dev filelock before 4.2.1; versions 3.10.2 and later affected by mode change issue

Identifiers

CVE-2026-112909
GHSA-69hj-f68j-2879

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.