{"items":[{"id":"NVI-00009086","kind":"vulnerability","title":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rfpc-qcw5-3pc4","CVE-2026-112939"],"plain_summary":"GitHub lists this reviewed advisory for filelock. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0e97e69bc0aa031a50e9c926daa941cd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:08:45.000Z","value":"4.7 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a9fbdcf81a542cbf91c029359ad7f303"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.140%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.03295. Missing scores are unknown.","source_id":"sr-0e97e69bc0aa031a50e9c926daa941cd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a9fbdcf81a542cbf91c029359ad7f303","url":"https://github.com/advisories/GHSA-rfpc-qcw5-3pc4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rfpc-qcw5-3pc4","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-0e97e69bc0aa031a50e9c926daa941cd","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-112939","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.841Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a9fbdcf81a542cbf91c029359ad7f303"],"technology":"filelock","known_exclusions":[],"conditions_summary":"`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async variants and a `FileLock` that has fallen back to a soft lock on `ENOSYS` decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who could have written that record.\n\nA local user who can write the marker but cannot remove it rewrites the holder's record to name a dead PID (process id). That position arises with an explicit `mode` with group or other write bits, or the default mode under a lax umask (the process setting that strips permission bits from new files), in a sticky or otherwise non-removable directory. The sticky bit is a directory flag that lets only a file's owner remove or rename it. The next contender running as the holder's account, or root, judges the lock stale, removes the live marker on that user's behalf and acquires it. Two processes then run the critical section together and neither gets an error. Affected versions are filelock 3.22.0 through 4.2.0 (finding `ANT-2026-W1H9NXUH`).\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N` scores 4.7 (Medium).** `AV:L` (local): the","public_affected_ranges":[">= 3.22.0, <= 4.2.0"]}],"null_published_at":"2026-11-04T10:04:47.596Z","source_updated_at":"2026-10-28T21:08:45.000Z","source_disclosed_at":"2026-10-28T21:08:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00009086","kind":"vulnerability","title":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rfpc-qcw5-3pc4","CVE-2026-112939"],"plain_summary":"GitHub lists this reviewed advisory for filelock. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a9fbdcf81a542cbf91c029359ad7f303"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:08:45.000Z","value":"4.7 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a9fbdcf81a542cbf91c029359ad7f303"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a9fbdcf81a542cbf91c029359ad7f303","url":"https://github.com/advisories/GHSA-rfpc-qcw5-3pc4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rfpc-qcw5-3pc4","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a9fbdcf81a542cbf91c029359ad7f303"],"technology":"filelock","known_exclusions":[],"conditions_summary":"`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async variants and a `FileLock` that has fallen back to a soft lock on `ENOSYS` decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who could have written that record.\n\nA local user who can write the marker but cannot remove it rewrites the holder's record to name a dead PID (process id). That position arises with an explicit `mode` with group or other write bits, or the default mode under a lax umask (the process setting that strips permission bits from new files), in a sticky or otherwise non-removable directory. The sticky bit is a directory flag that lets only a file's owner remove or rename it. The next contender running as the holder's account, or root, judges the lock stale, removes the live marker on that user's behalf and acquires it. Two processes then run the critical section together and neither gets an error. Affected versions are filelock 3.22.0 through 4.2.0 (finding `ANT-2026-W1H9NXUH`).\n\n## Severity\n\n**CVSS 3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N` scores 4.7 (Medium).** `AV:L` (local): the","public_affected_ranges":[">= 3.22.0, <= 4.2.0"]}],"null_published_at":"2026-10-31T22:13:31.275Z","source_updated_at":"2026-10-28T21:08:45.000Z","source_disclosed_at":"2026-10-28T21:08:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}