tox-dev

11 records · 11 with a public proof-of-concept

Disclosed vulnerabilities where the NVD names tox-dev as an affected vendor, highest CVSS first.

  1. HIGH 7.1CVE-2026-112940public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrit…

    filelock

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 6.3CVE-2026-112911public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory,…

    filelock

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 6.1CVE-2026-112937public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a li…

    filelock

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 6.1CVE-2026-112936public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can…

    filelock

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 6.1CVE-2026-112934public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, …

    filelock

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.5CVE-2026-112915public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall o…

    filelock

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 5.3CVE-2026-112914public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and…

    filelock

    AI risk analysis on Exploit-DB.ai →

  8. MEDIUM 4.7CVE-2026-112939public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the hold…

    filelock

    AI risk analysis on Exploit-DB.ai →

  9. MEDIUM 4.7CVE-2026-112935public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the s…

    filelock

    AI risk analysis on Exploit-DB.ai →

  10. LOW 3.3CVE-2026-112941public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local…

    filelock

    AI risk analysis on Exploit-DB.ai →

  11. LOW 2.5CVE-2026-112912public PoC2026-10-20

    filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platfo…

    filelock

    AI risk analysis on Exploit-DB.ai →