10 Total advisories
10 Vulnerabilities
0 Malware
Dependency scanning
Check whether filelock is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
LOW 2.5
CVE-2026-112907
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
MEDIUM 6.1
CVE-2026-112937
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
LOW 3.3
CVE-2026-112913
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
MEDIUM 5.3
CVE-2026-112914
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
HIGH 7.1
CVE-2026-112940
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
MEDIUM 4.7
CVE-2026-112906
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
MEDIUM 5.3
CVE-2026-22701
filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
MEDIUM 6.3
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
MEDIUM 6.3
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
MEDIUM 5.3
CVE-2026-22701
filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
Browse more PyPI advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes