AIKIDO-2026-95244
filelock is vulnerable to Race Condition (TOCTOU)
53
Medium Risk
This Affects:
filelockTL;DR
On network or coarse-mtime filesystems, stale lock breaking in break_lock_file could unlink a live lock when a peer recreates it within the same second because only modification time was re-checked after rename. SoftReadWriteLock heartbeat refresh could also terminate on transient OSError from marker touch failures, stopping lease renewal while the holder still believes it owns the lock. Either race allows a second process to acquire the same lock and run concurrently with the first. The patch re-verifies inode identity before unlinking stale locks and keeps the heartbeat alive across transient touch errors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use file locking on shared network or coarse-mtime filesystems.
Background info
filelock is vulnerable to Race Condition (TOCTOU) in versions 3.28.0 - 3.29.3.
How to fix this
Upgrade the filelock library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant