Description

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

INFO

Published Date :

2026-01-10T06:05:53.281Z

Last Modified :

2026-01-12T16:44:12.734Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-22702 vulnerability.

Vendors Products
Virtualenv
  • Virtualenv
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-22702.

URL Resource
https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc cve-icon cve-icon cve-icon
https://github.com/pypa/virtualenv/pull/3013 cve-icon cve-icon cve-icon
https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-22702 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-22702 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact