CVE-2026-22702: virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-10 · updated 2026-06-17
Weakness: CWE-59

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

Affected products

pypa virtualenv: before 20.36.1 — fixed in 20.36.1
Pypi Virtualenv: before 20.36.1; 0.8, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.9 (+239) — fixed in 20.36.1

How to fix

Upgrade to a fixed version: pypa virtualenv 20.36.1; Pypi Virtualenv 20.36.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-22702 or the next vulnerability affects your stack