CVE catalog
CVE-2026-22702
python-virtualenv affected and fixed versions
virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.
- Severity
- Medium · CVSS 4.5
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.10% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "python-virtualenv",
"status": "fixed",
"release": "sid",
"version": "21.5.1+ds-1"
},
{
"name": "python-virtualenv",
"status": "fixed",
"release": "forky",
"version": "21.5.1+ds-1"
},
{
"name": "python-virtualenv",
"status": "fixed",
"release": "trixie",
"version": "20.31.2+ds-1+deb13u1"
},
{
"name": "python-virtualenv",
"status": "vulnerable",
"release": "bookworm",
"version": "20.17.1+ds-1"
}
],
"fixed_versions": [
{
"bug": 1125191,
"name": "python-virtualenv",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "20.36.1+ds-1"
},
{
"bug": 1125191,
"name": "python-virtualenv",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "20.36.1+ds-1"
},
{
"bug": 1125191,
"name": "python-virtualenv",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "20.31.2+ds-1+deb13u1"
},
{
"bug": 1125191,
"name": "python-virtualenv",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "virtualenv",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.36.1"
}
]
}
],
"ecosystem": "PyPI",
"fixed_version": "20.36.1",
"provider_record_id": "GHSA-597G-3PHW-6986"
},
{
"name": "virtualenv",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.36.1"
}
]
}
],
"ecosystem": "PyPI",
"fixed_version": "20.36.1",
"provider_record_id": "PYSEC-2026-2009"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "14.04",
"versions": [
"1.10.1-1",
"1.11-1",
"1.11-2",
"1.11.4-1",
"1.11.4-1ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "16.04",
"versions": [
"1.11.6+ds-1",
"14.0.5+ds-1",
"14.0.5+ds-2",
"14.0.5+ds-4",
"15.0.0+ds-1",
"15.0.0+ds-2",
"15.0.1+ds-1",
"15.0.1+ds-2",
"15.0.1+ds-3",
"15.0.1+ds-3ubuntu1",
"15.0.1+ds-3ubuntu1.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"15.1.0+ds-1",
"15.1.0+ds-1.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"20.24.1+ds-1",
"20.24.6+ds-1",
"20.24.6+ds-2",
"20.25.0+ds-1",
"20.25.0+ds-2",
"20.25.0+ds-2ubuntu0.1~esm1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "25.10",
"versions": [
"20.29.1+ds-1",
"20.31.2+ds-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.04",
"versions": [
"20.31.2+ds-1",
"20.35.3+ds-1",
"20.35.4+ds-1",
"20.36.1+ds-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-22702"
},
{
"name": "python-virtualenv",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.29.3-160000.3.1"
}
]
}
],
"release": "leap 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "20.29.3-160000.3.1",
"provider_record_id": "OPENSUSE-SU-2026:20086-1"
},
{
"name": "python-virtualenv",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.29.3-160000.3.1"
}
]
}
],
"release": "linux enterprise server 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "20.29.3-160000.3.1",
"provider_record_id": "SUSE-SU-2026:20129-1"
},
{
"name": "python-virtualenv",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.29.3-160000.3.1"
}
]
}
],
"release": "linux enterprise server for sap applications 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "20.29.3-160000.3.1",
"provider_record_id": "SUSE-SU-2026:20129-1"
},
{
"name": "python-virtualenv",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.22.0-150400.9.9.1"
}
]
}
],
"release": "linux enterprise module for python 3 15 sp7",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "20.22.0-150400.9.9.1",
"provider_record_id": "SUSE-SU-2026:0233-1"
},
{
"name": "python-virtualenv",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.22.0-150400.9.9.1"
}
]
}
],
"release": "leap 15.6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "20.22.0-150400.9.9.1",
"provider_record_id": "SUSE-SU-2026:0233-1"
}
]
}Publisher notes
[bookworm] python-virtualenv: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [python3-virtualenv]Unknown
Source package: [python-virtualenv]
Details (2)
20.17.1+ds-1· all · bookwormAffected
dsa · python-virtualenv · debian · bookworm; dsa · python-virtualenv · debian · 12
20.17.1+ds-1· all · bookwormAffected
dsa · python-virtualenv · debian · bookworm; dsa · python-virtualenv · debian · 12
- [virtualenv]Unknown
Source package: [python-virtualenv]
Details (2)
20.17.1+ds-1· all · bookwormAffected
dsa · python-virtualenv · debian · bookworm; dsa · python-virtualenv · debian · 12
20.17.1+ds-1· all · bookwormAffected
dsa · python-virtualenv · debian · bookworm; dsa · python-virtualenv · debian · 12
[Debian 13 (Trixie)]
- [python3-virtualenv]Unknown
Source package: [python-virtualenv]
Details (2)
20.31.2+ds-1+deb13u1· all · trixieFixed · Fixed:
20.31.2+ds-1+deb13u1dsa · python-virtualenv · debian · 13
20.31.2+ds-1+deb13u1· all · trixieFixed · Fixed:
20.31.2+ds-1+deb13u1dsa · python-virtualenv · debian · 13
- [virtualenv]Unknown
Source package: [python-virtualenv]
Details (2)
20.31.2+ds-1+deb13u1· all · trixieFixed · Fixed:
20.31.2+ds-1+deb13u1dsa · python-virtualenv · debian · 13
20.31.2+ds-1+deb13u1· all · trixieFixed · Fixed:
20.31.2+ds-1+deb13u1dsa · python-virtualenv · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10055-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-22702]
- [https://osv.dev/vulnerability/PYSEC-2026-2009]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0233-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20129-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-22702]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20086-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-22702]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22702.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2933.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]