🟢 [LOW] CB-017: PID File Race Condition (TOCTOU) #26

New issue

Open

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

LOW 🟢

CVSS Score

N/A

CWE

CWE-367 (TOCTOU Race Condition)

Location

cli.py, read_pid() / write_pid()

Description

A race window exists between checking if the PID file exists and writing a new one. A second instance could start in this window.

Recommendation

Use file locking (fcntl.flock) for atomic PID management.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-017

## Security Finding from Audit > Parent issue: #1 ### Severity **LOW** 🟢 ### CVSS Score N/A ### CWE CWE-367 (TOCTOU Race Condition) ### Location `cli.py, read_pid() / write_pid()` --- ### Description A race window exists between checking if the PID file exists and writing a new one. A second instance could start in this window. --- ### Recommendation Use file locking (`fcntl.flock`) for atomic PID management. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-017*