SoftFileLock can mistakenly evict a freshly created lock file when an attacker removes an older marker that the library mistakenly deems stale. This occurs in versions 4.1.0 through 4.2.0 when two or more processes are waiting for a lock, the modification times are coarse or match, and the library preserves a stale observation. The eviction removes a live marker, allowing an attacker to exit a lock that was properly held by another user. The impact is loss of lock integrity, potentially leading to race conditions, data corruption, or unauthorized concurrent access to shared resources.

The vulnerability affects the tox‑dev:filelock package, specifically versions 4.1.0 up to, but not including, 4.2.1. Users of the SoftFileLock component in any Python environment that carries one of these affected releases are at risk.

The CVSS score of 4.7 indicates moderate severity; the EPSS score is 0.206% (<1%), and the issue is not listed in the CISA KEV catalog. The attack requires local file system access and the presence of two competing lock-user processes. The likely attack vector is a local user who can manipulate file timestamps and inodes to create a pre‑dated marker. Given these constraints, exploitation is limited to compromised or poorly isolated environments.