FKIE_CVE-2026-22702

Vulnerability from fkie_nvd - Published: 2026-01-10 07:16 - Updated: 2026-02-18 17:43
Severity ?
4.5 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
References
security-advisories@github.comhttps://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebcPatch
security-advisories@github.comhttps://github.com/pypa/virtualenv/pull/3013Issue Tracking, Patch
security-advisories@github.comhttps://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986Mitigation, Patch, Vendor Advisory
Impacted products
Vendor Product Version
virtualenv virtualenv *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1339346E-BA67-4C3F-8792-7F1829C91FA2",
              "versionEndExcluding": "20.36.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv\u0027s app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1."
    },
    {
      "lang": "es",
      "value": "virtualenv es una herramienta para crear entornos virtuales de Python aislados. Antes de la versi\u00f3n 20.36.1, las vulnerabilidades TOCTOU (Time-of-Check-Time-of-Use) en virtualenv permiten a atacantes locales realizar ataques basados en enlaces simb\u00f3licos en operaciones de creaci\u00f3n de directorios. Un atacante con acceso local puede explotar una condici\u00f3n de carrera entre las comprobaciones de existencia de directorios y su creaci\u00f3n para redirigir las operaciones de los archivos app_data y de bloqueo de virtualenv a ubicaciones controladas por el atacante. Este problema ha sido parcheado en la versi\u00f3n 20.36.1."
    }
  ],
  "id": "CVE-2026-22702",
  "lastModified": "2026-02-18T17:43:08.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-10T07:16:02.857",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/pypa/virtualenv/pull/3013"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.