4.5Medium
CVE-2026-22702virtualenv Has TOCTOU Vulnerabilities in Directory Creation
Description
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| pypa | virtualenv | < 20.36.1 | |
| virtualenv | virtualenv | < 20.36.1 |
References and patches
- https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 MitigationPatchVendor Advisory
- https://github.com/pypa/virtualenv/pull/3013 Issue TrackingPatch
- https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc Patch
CPE matches (NVD) (1)
cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*< 20.36.1