PT-2026-2252 · Unknown+1 · Virtualenv+1

Tsigouris007 · Published 2026-01-01 · Updated 2026-03-17 · CVE-2026-22702

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 20.36.1

Description virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, Time-of-Check-Time-of-Use (TOCTOU) vulnerabilities exist in virtualenv that allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app data and lock file operations to attacker-controlled locations. The vulnerability affects the directory creation operations.

Recommendations Update virtualenv to version 20.36.1 or later.

Exploit

Fix

Race Condition

Link Following

Weakness Enumeration

CWE-362

CWE-59

Related Identifiers

AZL-74210

AZL-74237

BIT-VIRTUALENV-2026-22702

CVE-2026-22702

GHSA-597G-3PHW-6986

OPENSUSE-SU-2026:10055-1

OPENSUSE-SU-2026:20086-1

SUSE-SU-2026:0233-1

SUSE-SU-2026:20129-1

Affected Products

Debian

Virtualenv

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22702.json · Exploit
• https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc · Patch
• https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 · Vendor Advisory
• https://github.com/pypa/virtualenv/pull/3013 · Patch
• https://osv.dev/vulnerability/AZL-74237 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-22702 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10055-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22702 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22702 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22702 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20086-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22702 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-597g-3phw-6986 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-74210 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22702 · Vendor Advisory