LOW 3.3 GitHub
CVE-2026-112913
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: `<database>-journal`, the rollback journal (pages saved to undo an interrupted write); `<database>-wal`, the write-ahead log (changes kept outside the main file); and `<database>-shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before
Affected Products
- pip/filelock >= 3.20.4, <= 4.2.0
References
- https://github.com/advisories/GHSA-9vhv-jxww-xfm5
- https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5
- https://github.com/tox-dev/filelock/pull/834
- https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d
This low severity vulnerability with a CVSS score of 3.3 was published on 2026-10-23 via GitHub. Affected: pip/filelock >= 3.20.4, <= 4.2.0.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.