filelock (PyPI)
A platform-independent file lock for Python.
Advisories
22
Latest version
4.2.6
Released Oct 31, 2026
License
MIT
OpenSSF Scorecard
—
How to fix
Upgrading to 4.2.1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "filelock>=4.2.6"poetry
poetry add "filelock>=4.2.6"uv
uv add "filelock>=4.2.6"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-wfhq-q4j2-c37m filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock |
Low EPSS 0.13% |
>= 4.1.0, < 4.2.1 | 4.2.1 |
| GHSA-6627-m3xw-93mp filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold |
Medium | >= 3.30.0, < 4.2.1 | 4.2.1 |
| GHSA-9c4x-gm8v-wgc4 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion |
Medium EPSS 0.15% |
>= 3.30.0, < 4.2.1 | 4.2.1 |
| GHSA-8mx5-7m5m-r77g filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL |
Medium | >= 3.10.0, < 4.2.1 | 4.2.1 |
| GHSA-cwqr-hh33-gh44 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout |
Medium EPSS 0.22% |
>= 3.20.4, < 4.2.1 | 4.2.1 |
| GHSA-rfpc-qcw5-3pc4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker |
Medium EPSS 0.14% |
>= 3.22.0, < 4.2.1 | 4.2.1 |
| GHSA-9j6q-wvj5-jgjg filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker |
Low EPSS 0.21% |
>= 3.32.6, < 4.2.1 | 4.2.1 |
| GHSA-69hj-f68j-2879 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path |
Medium EPSS 0.22% |
< 4.2.1 | 4.2.1 |
| GHSA-j8f7-rjxc-mr56 filelock: ReadWriteLock follows a symlink at the lock path into SQLite |
Medium EPSS 0.23% |
>= 3.20.4, < 4.0.9 | 4.0.9 |
| GHSA-m462-7rxw-wvpg filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses |
Medium | >= 3.30.0, < 4.2.1 | 4.2.1 |
| GHSA-fj95-fr6c-h845 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record |
Medium EPSS 0.23% |
>= 4.0.0, < 4.2.1 | 4.2.1 |
| GHSA-fq56-3cx3-fjxp filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders |
Medium EPSS 0.13% |
>= 3.22.0, < 4.2.1 | 4.2.1 |
| GHSA-jqc4-5cvw-7w85 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name |
Medium EPSS 0.16% |
>= 4.1.0, < 4.2.1 | 4.2.1 |
| GHSA-9vhv-jxww-xfm5 filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database |
Low | >= 3.20.4, < 4.2.1 | 4.2.1 |
| GHSA-567q-5qvw-pf92 filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break |
Low | >= 3.22.0, < 4.2.1 | 4.2.1 |
| GHSA-2g95-wg33-c5x2 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse |
Medium EPSS 0.17% |
>= 4.1.0, < 4.2.1 | 4.2.1 |
| GHSA-crv4-6mhj-j5jh filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory |
Medium EPSS 0.16% |
>= 4.1.0, < 4.2.1 | 4.2.1 |
| GHSA-v4x8-3wr5-3wq8 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files |
High EPSS 0.19% |
>= 3.20.4, < 4.2.1 | 4.2.1 |
| GHSA-qmgc-5h2g-mvrw filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock |
Medium EPSS 0.13% |
< 3.20.3 | 3.20.3 |
| GHSA-qmgc-5h2g-mvrw filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock |
Medium EPSS 0.13% |
< 3.20.3 | 3.20.3 |
| GHSA-w853-jp5j-5j7f filelock has a TOCTOU race condition which allows symlink attacks during lock file creation |
Medium EPSS 0.20% |
< 3.20.1 | 3.20.1 |
| GHSA-w853-jp5j-5j7f filelock has a TOCTOU race condition which allows symlink attacks during lock file creation |
Medium EPSS 0.20% |
< 3.20.1 | 3.20.1 |
Source: https://github.com/tox-dev/filelock
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor