CVE-2026-22701 (Medium) detected in filelock-3.19.1-py3-none-any.whl

[mend-bolt-for-github]

CVE-2026-22701 - Medium Severity Vulnerability

Vulnerable Library - filelock-3.19.1-py3-none-any.whl

A platform independent file lock.

Library home page: https://files.pythonhosted.org/packages/42/14/42b2651a2f46b022ccd948bca9f2d5af0fd8929c4eec235b8d6d844fbe67/filelock-3.19.1-py3-none-any.whl

Path to dependency file: /test-requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260307031138_XKLXPW/python_IBUTGV/20260307031140/filelock-3.19.1-py3-none-any.whl

Dependency Hierarchy:

• tox-4.30.3-py3-none-any.whl (Root Library)
  • ❌ filelock-3.19.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0ef017910357920860e070034f01429aa45746e4

Found in base branch: main

Vulnerability Details

filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.

Publish Date: 2026-01-10

URL: CVE-2026-22701

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-01-10

Fix Resolution (filelock): 3.20.3

Direct dependency fix Resolution (tox): 4.31.0

---

Step up your Open Source Security Game with Mend here