{"items":[{"id":"NVI-00009126","kind":"vulnerability","title":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8mx5-7m5m-r77g","CVE-2026-112910"],"plain_summary":"GitHub lists this reviewed advisory for filelock. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-bfe4a22238be2a31c30dc2f8ff2eb4c4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:08:55.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-bfe4a22238be2a31c30dc2f8ff2eb4c4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-bfe4a22238be2a31c30dc2f8ff2eb4c4","url":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8mx5-7m5m-r77g","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-bfe4a22238be2a31c30dc2f8ff2eb4c4"],"technology":"filelock","known_exclusions":[],"conditions_summary":"filelock on Windows ignores the `mode` argument. `FileLock(path, mode=0o600)` creates the same file as `FileLock(path)`: one with no security descriptor of its own (the Windows record that says who may access a file). Its access list, or ACL, is whatever the lock directory hands down to new files. filelock creates the `ReadWriteLock` database, which it asks to be `0o600`, the same way. In a directory whose inheritable ACL grants other local accounts access to new files, those accounts can open the lock file or database. They can take the byte-range lock (a lock on a span of bytes in a file) once the owner releases it and keep the owner's later `acquire()` calls waiting or timing out. They can read holder metadata an `on_acquired` hook left in a `preserve_lock_file=True` file. Where the directory hands down modify access, they can write to both files.\n\n`lock.mode` still reports `0o600`. The documentation neither promises an ACL on Windows nor says that Windows drops the mode. On Unix the same mode keeps other accounts out. Mutual exclusion between processes that follow the protocol holds on either platform. Affected versions are filelock 3.10.0 through 4.2.0 on Windows.\n\nAnthropic's","public_affected_ranges":[">= 3.10.0, <= 4.2.0"]}],"null_published_at":"2026-10-31T22:13:31.285Z","source_updated_at":"2026-10-28T21:08:55.000Z","source_disclosed_at":"2026-10-28T21:08:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}