pypa virtualenv up to 20.36.0 app_data/lock link following

Summaryinfo

A vulnerability, which was classified as critical, was found in pypa virtualenv up to 20.36.0. Affected by this vulnerability is the function app_data/lock. Executing a manipulation can lead to link following. The identification of this vulnerability is CVE-2026-22702. The attack can only be executed locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in pypa virtualenv up to 20.36.0 and classified as critical. This vulnerability affects the function app_data/lock. The manipulation with an unknown input leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-22702 since 01/08/2026. The exploitation appears to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 282556 (Linux Distros Unpatched Vulnerability : CVE-2026-22702), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 20.36.1 eliminates this vulnerability. Applying the patch dec4cec5d16edaf83a00a658f32d1e032661cebc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (282556) and EUVD (EUVD-2026-1869). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• pypa

Name

• virtualenv

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14
• 20.15
• 20.16
• 20.17
• 20.18
• 20.19
• 20.20
• 20.21
• 20.22
• 20.23
• 20.24
• 20.25
• 20.26
• 20.27
• 20.28
• 20.29
• 20.30
• 20.31
• 20.32
• 20.33
• 20.34
• 20.35
• 20.36.0

License

• open-source

Website

• Product: https://github.com/pypa/virtualenv/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion