Microsoft cbl2 python-filelock 3.0.12-13 vulnerabilities

Latest Microsoft cbl2 python-filelock 3.0.12-13 CVEs

Newest publication first

1. CVE-2025-68146 filelock has TOCTOU race condition that allows symlink attacks during lock file creation

   Published 2025-12-16

   Medium·CVSS 6.5 EPSS 0.20%

   filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.