CVE-2026-22702

A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based attacks, the attacker can redirect virtualenv's application data and lock file operations to locations they control. This could lead to information disclosure or data tampering.

This vulnerability is rated Moderate for Red Hat. It affects virtualenv and allows a local attacker to perform symlink-based attacks during directory creation. Exploitation requires local access and a race condition, limiting its impact in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Given that this vulnerability requires local access and exploits a race condition during directory creation, ensuring that virtualenv operations are performed in trusted and controlled environments can reduce the risk. Limiting the execution of virtualenv by untrusted users or within sandboxed environments can help mitigate potential information disclosure or data tampering.