# Tox-Dev Filelock vulnerabilities Source: https://junglewise.ai/threats/technologies/tox-dev-filelock Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/tox-dev-filelock.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Tox-Dev Filelock: 0 in the last 7 days and 14 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112938, was published on 5 November 2026. 14 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 14 - Last 90 days: 14 - All time: 14 (0 critical, 0 exploited in the wild) ## About Tox-Dev Filelock Python library for cross-platform file locking with process-safe synchronization. ## Latest Tox-Dev Filelock vulnerabilities - [CVE-2026-112938: filelock StrictSoftFileLock symlink race privilege escalation](https://junglewise.ai/threats/cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in) (medium, CVSS 5.8, published 5 Nov 2026) - [CVE-2026-112910: filelock WindowsFileLock mode parameter permission enforcement failure](https://junglewise.ai/threats/cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the) (medium, CVSS 5.3, published 5 Nov 2026) - [CVE-2026-112908: filelock StrictSoftFileLock directory permission bypass](https://junglewise.ai/threats/cve-2026-112908-filelock-strictsoftfilelock-creates-its-claim-directories) (medium, CVSS 5.3, published 5 Nov 2026) - [CVE-2026-112940: filelock ReadWriteLock SQLite database overwrite in POSIX](https://junglewise.ai/threats/cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3) (high, CVSS 7.1, published 20 Oct 2026) - [CVE-2026-112939: filelock SoftFileLock PID spoofing privilege escalation](https://junglewise.ai/threats/cve-2026-112939-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 4.7, published 20 Oct 2026) - [CVE-2026-112937: filelock ReadWriteLock insecure temporary directory cleanup](https://junglewise.ai/threats/cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112936: filelock ReadWriteLock symlink following vulnerability](https://junglewise.ai/threats/cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112935: filelock SoftFileLock file lock bypass](https://junglewise.ai/threats/cve-2026-112935-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 4.7, published 20 Oct 2026) - [CVE-2026-112934: filelock SoftReadWriteLock directory traversal and lock stalling](https://junglewise.ai/threats/cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112915: filelock ReadWriteLock unbounded SQLite query denial of service](https://junglewise.ai/threats/cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 5.5, published 20 Oct 2026) - [CVE-2026-112914: filelock SoftFileLock symlink attack via stale marker](https://junglewise.ai/threats/cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-112911: filelock StrictSoftFileLock directory adoption vulnerability](https://junglewise.ai/threats/cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 6.3, published 20 Oct 2026) - [CVE-2026-112909: filelock UnixFileLock file truncation on rename](https://junglewise.ai/threats/cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112906: filelock SoftFileLock stale marker reuse race condition](https://junglewise.ai/threats/cve-2026-112906-filelock-is-a-platform-independent-file-lock-for-python-from-4-1) (medium, CVSS 4.7, published 20 Oct 2026) ## Most severe Tox-Dev Filelock vulnerabilities - [CVE-2026-112940: filelock ReadWriteLock SQLite database overwrite in POSIX](https://junglewise.ai/threats/cve-2026-112940-filelock-is-a-platform-independent-file-lock-for-python-from-3) (high, CVSS 7.1, published 20 Oct 2026) - [CVE-2026-112911: filelock StrictSoftFileLock directory adoption vulnerability](https://junglewise.ai/threats/cve-2026-112911-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 6.3, published 20 Oct 2026) - [CVE-2026-112936: filelock ReadWriteLock symlink following vulnerability](https://junglewise.ai/threats/cve-2026-112936-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112934: filelock SoftReadWriteLock directory traversal and lock stalling](https://junglewise.ai/threats/cve-2026-112934-filelock-is-a-platform-independent-file-lock-for-python-from-4-0) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112909: filelock UnixFileLock file truncation on rename](https://junglewise.ai/threats/cve-2026-112909-filelock-is-a-platform-independent-file-lock-for-python-prior-to) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112937: filelock ReadWriteLock insecure temporary directory cleanup](https://junglewise.ai/threats/cve-2026-112937-filelock-is-a-platform-independent-file-lock-for-python-from-4-1) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-112938: filelock StrictSoftFileLock symlink race privilege escalation](https://junglewise.ai/threats/cve-2026-112938-filelock-strictsoftfilelock-follows-a-symbolic-link-swapped-in) (medium, CVSS 5.8, published 5 Nov 2026) - [CVE-2026-112915: filelock ReadWriteLock unbounded SQLite query denial of service](https://junglewise.ai/threats/cve-2026-112915-filelock-is-a-platform-independent-file-lock-for-python-from-3) (medium, CVSS 5.5, published 20 Oct 2026) - [CVE-2026-112914: filelock SoftFileLock symlink attack via stale marker](https://junglewise.ai/threats/cve-2026-112914-filelock-is-a-platform-independent-file-lock-for-python-from-4-1) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-112910: filelock WindowsFileLock mode parameter permission enforcement failure](https://junglewise.ai/threats/cve-2026-112910-filelock-windowsfilelock-ignores-mode-a-0o600-lock-file-and-the) (medium, CVSS 5.3, published 5 Nov 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 11 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Tox-Dev Filelock vulnerabilities", https://junglewise.ai/threats/technologies/tox-dev-filelock, 13 November 2026.