CVE-2026-22701: Medium Vulnerability in tox-dev filelock

The vulnerability identified as CVE-2026-22701 pertains to a time-of-check to time-of-use (TOCTOU) race condition within the SoftFileLock implementation of the filelock package, a widely used library for file locking in Python applications. This vulnerability allows an attacker with local filesystem access and permissions to create symlinks to exploit a race condition between permission validation and file creation. Specifically, the issue resides in the _acquire() method, which can lead to lock operations failing or behaving unexpectedly.

The severity of this vulnerability is classified as medium, with a CVSS score of 5.3. The attack vector is local, requiring low privileges and no user interaction. The potential impact includes denial of service, which can disrupt normal operations of applications relying on the filelock package. Therefore, it is crucial for organizations using versions prior to 3.20.3 to prioritize remediation efforts.

With the publication date of January 10, 2026, and an analysis status of 'Analyzed', this vulnerability has been recognized and patched in version 3.20.3 of the filelock package. Organizations utilizing this package should ensure that they have updated to the latest version to mitigate any associated risks.

Risk to organizations includes potential denial of service, which may affect application availability. Given the local attack vector, it is essential to evaluate which systems have the filelock package installed and assess the local access controls in place.

Organizations should prioritize patching immediately.

To understand the broader implications of this vulnerability, it is important to recognize that TOCTOU vulnerabilities can lead to unexpected behavior in software systems. This instance emphasizes the need for thorough validation and security practices during the development of libraries that interact with filesystem operations.