Is CVE-2026-112940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112940 being exploited in the wild.

How severe is CVE-2026-112940?

High severity, with a CVSS score of 7.1, published 20 October 2026.

Which products and versions are affected?

filelock (PyPI) >= 3.20.4, <= 4.2.0, ECOSYSTEM:introduced=3.20.4,fixed=4.2.1; Tox-Dev Filelock 3.20.4 to 4.2.0.

Is there a fix for CVE-2026-112940?

Yes. filelock (PyPI): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112940 attacked?

It is attacked with local access or from the adjacent network, in a software library.

Am I affected by CVE-2026-112940?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112940: filelock ReadWriteLock SQLite database overwrite in POSIX

Q: Is there a fix for CVE-2026-112940?

Yes. filelock (PyPI): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112940 attacked?

It is attacked with local access or from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-112940?

Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112940 · Severity: high · CVSS 7.1 · Published 2026-10-20

filelock is a Python file locking library used by applications to coordinate access to shared resources. Versions 3.20.4 through 4.2.1 allow attackers on POSIX systems with rename access in the parent directory to manipulate SQLite database files, potentially overwriting or deleting files controlled by applications using filelock. An attacker could use this to corrupt application data or cause system malfunction.

Technologies: filelock (PyPI), Tox-Dev Filelock. Vendors: PyPI, Tox-Dev.

Quick answers

Is CVE-2026-112940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112940 being exploited in the wild.
How severe is CVE-2026-112940?: High severity, with a CVSS score of 7.1, published 20 October 2026.
Which products and versions are affected?: filelock (PyPI) >= 3.20.4, <= 4.2.0, ECOSYSTEM:introduced=3.20.4,fixed=4.2.1; Tox-Dev Filelock 3.20.4 to 4.2.0.
Is there a fix for CVE-2026-112940?: Yes. filelock (PyPI): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112940 attacked?: It is attacked with local access or from the adjacent network, in a software library.
Am I affected by CVE-2026-112940?: Check whether you run filelock (PyPI) or Tox-Dev Filelock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

filelock (PyPI): upgrade to 4.2.1 or later
```
pip install "filelock>=4.2.1"
```

Technical details

ReadWriteLock stores its lock state in a SQLite database and passes file descriptor paths to SQLite that can be resolved back to predictable filenames. On POSIX systems, an attacker with rename permissions in the parent directory can perform a time-of-check-time-of-use (TOCTOU) attack by swapping file names, causing SQLite to overwrite or unlink unintended files. Additional conditions include a writable adjacent hot journal file for attacker-controlled content overwrites.

Affected products

tox-dev filelock 3.20.4 to 4.2.0

Identifiers

CVE-2026-112940
GHSA-v4x8-3wr5-3wq8

Timeline

2026-10-20: disclosed
2026-10-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.