filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a
    forged process identifier in a marker that an attacker can modify but cannot remove, allowing an
    authorized contender such as another process of the holder's account or root to act as a confused deputy,
    remove the live marker, and admit another holder. This issue is fixed in version 4.2.1. (CVE-2026-112939)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a     forged process identifier in a marker that an attacker can modify but cannot remove, allowing an     authorized contender such as another process of the holder's account or root to act as a confused deputy,     remove the live marker, and admit another holder. This issue is fixed in version 4.2.1. (CVE-2026-112939)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478204	Chainguard: multiple nemo-rl-cuda-13.0 packages: security update to 0.7.0-r20	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478204	Chainguard: multiple nemo-rl-cuda-13.0 packages: security update to 0.7.0-r20	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
477786	SCA: security update for filelock (GHSA-rfpc-qcw5-3pc4)	Tenable Cloud Security	SCA Checks	Local	medium
477786	SCA: security update for filelock (GHSA-rfpc-qcw5-3pc4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
369013	Linux Distros Unpatched Vulnerability : CVE-2026-112939	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-112939

medium

Tenable Plugins

medium

medium

medium

medium

medium