📦

virtualenv

Vendor: virtualenv

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 1 Code Available
Total RCEs 1 Remote Access
Total CVEs 4 Total Indexed
Avg. EPSS 2.49% Exploit Prob.
Latest CVE CVE-2026-22702 Jan 10

Security Vulnerability Index

Page 1 / 1
4.5 CVSS
CVE-2026-22702

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

EPSS: 0.09%
7.8 CVSS
CVE-2024-53899
RCE

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

EPSS: 1.57%
5.9 CVSS
CVE-2013-5123
Exploit Found

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

EPSS: 7.99%
1.2 CVSS
CVE-2011-4617

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

EPSS: 0.32%