virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
References
| Link | Resource |
|---|---|
| https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc | Patch |
| https://github.com/pypa/virtualenv/pull/3013 | Issue Tracking Patch |
| https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 | Mitigation Patch Vendor Advisory |
Configurations
History
18 Feb 2026, 17:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc - Patch | |
| References | () https://github.com/pypa/virtualenv/pull/3013 - Issue Tracking, Patch | |
| References | () https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 - Mitigation, Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:* | |
| First Time |
Virtualenv virtualenv
Virtualenv |
10 Jan 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-10 07:16
Updated : 2026-02-18 17:43
NVD link : CVE-2026-22702
Mitre link : CVE-2026-22702
CVE.ORG link : CVE-2026-22702
JSON object : View
Products Affected
virtualenv
- virtualenv