4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22702

CVE-2026-22702: virtualenv Has TOCTOU Vulnerabilities in Directory Creation

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22702

CVE-2026-22702:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
virtualenv	pip	< 20.36.1	20.36.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in virtualenv. An attacker with local access could create a symbolic link between the time virtualenv checks for the existence of a directory and the time it creates it. This would allow the attacker to control the location where directories for application data and locks are created, leading to potential cache poisoning, information disclosure, or denial of service.

The patch addresses this by replacing the non-atomic "check-then-create" pattern with an atomic os.makedirs(..., exist_ok=True) call. This ensures that if the directory already exists (even as a symlink), the operation doesn't fail and doesn't follow the symlink in an insecure way.

The analysis of the commit dec4cec5d16edaf83a00a658f32d1e032661cebc reveals changes in three key functions across two files:

virtualenv.app_data.make_app_data: This function is responsible for creating the application data directory. The patch replaces a vulnerable if not os.path.isdir(folder): os.makedirs(folder) block with os.makedirs(folder, exist_ok=True). This function is a primary entry point for the vulnerability when virtualenv initializes its application data cache.
virtualenv.util.lock._CountedFileLock.__init__: This constructor for a file lock also contained a similar TOCTOU vulnerability when creating the parent directory for the lock file: if not os.path.isdir(parent): os.makedirs(parent). This was also replaced with an atomic os.makedirs(parent, exist_ok=True).
virtualenv.util.lock._FileSystemMutex._lock_file: This function, responsible for creating a mutex lock file, was also vulnerable. It called os.makedirs(str(self.path)) without exist_ok=True, which is now added in the patch. This could be exploited to manipulate lock files.

These three functions are the direct locations of the vulnerable code and would appear in a runtime profile if the race condition were to be triggered during the execution of virtualenv.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.