CVE-2026-22702

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-59 CWE-362

Affected software

Vendor	Product	Versions
pypa	virtualenv	< 20.36.1

References

https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebcPatch
https://github.com/pypa/virtualenv/pull/3013Issue Tracking, Patch
https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986Mitigation, Patch, Vendor Advisory

Timeline

Published: Jan 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-227035.5Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted t CVE-2026-227045.4HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XS CVE-2026-227056.4RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to v CVE-2026-227066.5Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did CVE-2026-227075.4Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints d CVE-2026-227089.8Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode en CVE-2026-2270910.0vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sa CVE-2026-22715.5A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_c CVE-2026-227105.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediaw CVE-2026-227116.9Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site S CVE-2026-227124.3Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki CVE-2026-227135.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediaw