filelock package vulnerabilities
Advisories affecting the filelock package. A list cannot tell you whether your installed version is affected — the dependency check can.
16 vulnerabilities tracked.
Check which version you are running → — this page lists advisories for the package; only a version check can tell you whether you are affected.
- 6.3 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
- 6.1 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
- 6.1 filelock: ReadWriteLock follows a symlink at the lock path into SQLite
- 6.1 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
- 6.1 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
- 5.8 filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
- 5.5 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
- 5.3 filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
- 5.3 filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
- 4.7 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
- 4.7 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
- 4.7 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
- 3.3 filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
- 3.3 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
- 2.5 filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
- 2.5 filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that filelock is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other packages tracked here
node-forge vllm github.com/labstack/echo/v4 github.com/labstack/echo/v5 undici virtualenv pypdf authlib @highcharts/dashboards adminneo-org/adminneo highcharts GitPython org.keycloak:keycloak-services zip org.mariadb.jdbc:mariadb-java-client seroval @highcharts/grid-pro rustls mlflow phpoffice/phpspreadsheet onnx russh pyasn1 better-auth