AIKIDO-2026-74461
filelock is vulnerable to Race Condition
30
Low Risk
This Affects:
filelockTL;DR
A SoftFileLease stores its per-claim heartbeat state in shared instance attributes while the surrounding lock context is thread-local by default. When a second thread fails to acquire the same lease object, its _acquire path unconditionally stops the heartbeat that belongs to the thread actually holding the lease and overwrites the active token. The holder keeps reporting the lease as held and receives no compromise callback, but its marker is no longer refreshed, so once the lease duration elapses a peer can break the marker and acquire the same claim concurrently. The fix scopes each claim and heartbeat to the thread-local context that acquired it so a contender's failed acquisition can no longer tear down another thread's live claim.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use a SoftFileLease across multiple threads with the default thread-local context.
Background info
filelock is vulnerable to Race Condition in versions 3.30.0 - 3.31.0.
How to fix this
Upgrade the filelock library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant