CVE-2026-22702
📋 TL;DR
This CVE describes a TOCTOU vulnerability in virtualenv that allows local attackers to exploit race conditions during directory creation. Attackers can redirect app_data and lock file operations to attacker-controlled locations via symlink attacks. Users of virtualenv versions prior to 20.36.1 are affected.
💻 Affected Systems
- virtualenv
📦 What is this software?
Virtualenv by Virtualenv
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation, arbitrary file write/read, or code execution if attacker can control symlink targets and influence virtualenv operations.
Likely Case
Local user could manipulate virtualenv's temporary files or configuration data, potentially causing denial of service or data corruption.
If Mitigated
Limited impact with proper file permissions and isolation; attacker would need local access and ability to create symlinks in target directories.
🎯 Exploit Status
Exploitation requires local access, ability to create symlinks, and precise timing to win the race condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.36.1
Vendor Advisory: https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986
Restart Required: No
Instructions:
1. Upgrade virtualenv using pip: 'pip install --upgrade virtualenv>=20.36.1' 2. Verify installation: 'virtualenv --version' should show 20.36.1 or higher 3. Recreate any existing virtual environments if they were created with vulnerable versions.
🔧 Temporary Workarounds
Restrict directory permissions
linuxSet strict permissions on directories where virtualenv operates to prevent unauthorized symlink creation
chmod 700 ~/.local/share/virtualenv
chmod 700 /tmp/virtualenv_*
Use isolated temporary directories
linuxRun virtualenv with private temporary directories to limit symlink attack surface
TMPDIR=$(mktemp -d) virtualenv myenv
🧯 If You Can't Patch
- Run virtualenv operations as isolated users with minimal privileges
- Monitor filesystem for suspicious symlink creation in virtualenv directories
🔍 How to Verify
Check if Vulnerable:
Check virtualenv version: 'virtualenv --version' or 'pip show virtualenv | grep Version'. If version is less than 20.36.1, system is vulnerable.Check Version:
virtualenv --versionVerify Fix Applied:
After upgrade, confirm version is 20.36.1 or higher and test virtualenv creation in a controlled environment.📡 Detection & Monitoring
Log Indicators:
- Failed virtualenv creation attempts with permission errors
- Unexpected symlink operations in virtualenv directories
Network Indicators:
- None - this is a local filesystem attack
SIEM Query:
Process creation where command contains 'virtualenv' AND file creation events in virtualenv directories with symlink operations