CVE-2026-22702Medium· 4.5▾ SunlitA flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based at…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.08%
0.08% → 0.1%
Last analysed / modified upstream
A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based attacks, the attacker can redirect virtualenv's application data and lock file operations to locations they control. This could lead to information disclosure or data tampering.
virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition — rated Moderate by Red Hat. Released 2026-01-10, updated 2026-10-15.
Affected:
No fix planned:
Fix deferred
Workarounds / mitigations:
virtualenv operations are performed in trusted and controlled environments can reduce the risk. Limiting the execution of virtualenv by untrusted users or within sandboxed environments can help mitigate potential information disclosure or data tampering.Affected packages:
virtualenv < 20.36.1Patched in:
virtualenv 20.36.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79676Medium· 5.9nltk: NLTK: Information disclosure via path traversal with symlink bypass (CVE-2026-79676)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-96644High· 7.1pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser (CVE-2026-96644)
CVE-2026-112892High· 7.5pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)