This vulnerability is a time‑of‑check to time‑of‑use race in directory creation within virtualenv. Prior to version 20.36.1 an attacker with local access can create a symlink at a path that virtualenv checks for existence before creating. The resulting race allows the symlink to be resolved to an attacker‑controlled target so that virtualenv’s app_data or lock files are written to an unintended location. This can lead to unintended file writes or overwriting of system files and data leakage. The weakness is represented by CWE‑362 for race conditions and CWE‑59 for unsafe path handling.

Any installation of the Python virtualenv package from the PyPA project that predates version 20.36.1. The vulnerability applies to all platforms where virtualenv can be executed locally, including Windows, macOS and Linux systems that use Python environments.

The CVSS score of 4.5 indicates moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. A local attacker who can run code in the user’s environment can trigger the race by manipulating the filesystem just before virtualenv is invoked. Because the flaw depends on creating a symlink after the existence check, an attacker must have the ability to write to the target directory and to control the symlink creation timing; otherwise the vulnerability cannot be abused.