virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1428 advisory.

    virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU     (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based     attacks on directory creation operations. An attacker with local access can exploit a race condition     between directory existence checks and creation to redirect virtualenv's app_data and lock file operations     to attacker-controlled locations. This issue has been patched in version 20.36.1. (CVE-2026-22702)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20086-1 advisory.

    - CVE-2026-22702: Fixed local attacker can redirect file operations via TOCTOU race condition     (bsc#1256458).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0233-1 advisory.

    - CVE-2026-22702: Fixed local attacker can redirect file operations via TOCTOU race condition     (bsc#1256458).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fd3855b8-efbc-11f0-9e3f-b0416f0c4c67 advisory.

    https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 reports:
    virtualenv is a tool for creating isolated virtual python environments.
    Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use)     vulnerabilities in virtualenv allow local attackers to perform     symlink-based attacks on directory creation operations.  An attacker     with local access can exploit a race condition between directory     existence checks and creation to redirect virtualenv's app_data and     lock file operations to attacker-controlled locations.  This issue     has been patched in version 20.36.1.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU     (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based     attacks on directory creation operations. An attacker with local access can exploit a race condition     between directory existence checks and creation to redirect virtualenv's app_data and lock file operations     to attacker-controlled locations. This issue has been patched in version 20.36.1. (CVE-2026-22702)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299546	Amazon Linux 2023 : python3.13-virtualenv (ALAS2023-2026-1428)	Nessus	Amazon Linux Local Security Checks	medium
296561	openSUSE 16 Security Update : python-virtualenv (openSUSE-SU-2026:20086-1)	Nessus	SuSE Local Security Checks	medium
296447	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-virtualenv (SUSE-SU-2026:0233-1)	Nessus	SuSE Local Security Checks	medium
282632	FreeBSD : virtualenv -- CWE-59: Improper Link Resolution Before File Access ('Link Following') (fd3855b8-efbc-11f0-9e3f-b0416f0c4c67)	Nessus	FreeBSD Local Security Checks	medium
282556	Linux Distros Unpatched Vulnerability : CVE-2026-22702	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-22702

medium

Tenable Plugins

medium

medium

medium

medium

medium