Bug 2428441 (CVE-2026-22702)

Summary:	CVE-2026-22702 virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, anthomas, aprice, bdettelb, carogers, caswilli, crizzo, dnakabaa, doconnor, ehelms, erezende, ggainey, gtanzill, haoli, hasun, hkataria, jajackso, jbuscemi, jcammara, jdobes, jfula, jkoehler, jmitchel, jneedle, joehler, jowilson, jsamir, juwatts, jwong, kaycoth, kegrant, kgaikwad, koliveir, kshier, lcouzens, lphiri, mabashia, mhayden, mhulan, mskarbek, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pbraun, pcreech, ptisnovs, rchan, sdawley, sdoran, shvarugh, simaishi, smallamp, smcdonal, stcannon, syedriko, teagle, tfister, thavo, tmalecek, ttakamiy, xdharmai, yguenane, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based attacks, the attacker can redirect virtualenv's application data and lock file operations to locations they control. This could lead to information disclosure or data tampering.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2428458, 2428459
Bug Blocks:

Description OSIDB Bzimport 2026-01-10 07:01:39 UTC

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.