BSD Portsvirtualenv -- CWE-59: Improper Link Resolution Before File Access ('Link Following')
· CVE-2026-22702 · VuXML entry
https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 reports: virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory …
Affected versions
- py310-virtualenv, py311-virtualenv, py312-virtualenv, py313-virtualenv, py313t-virtualenv, py314-virtualenv < 20.36.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | devel/py-virtualenv | 20.29.3 | vulnerable since 2026-01-12 | |
| OpenBSD | devel/py-virtualenv | 21.14.12 | out of range, by version | |
| NetBSD | devel/py-virtualenv | 21.7.9 | not listed | |
| MidnightBSD | devel/py-virtualenv | 20.26.0_1 | in range, by version | |
| FreeBSD | devel/py-virtualenv | 21.14.13 | fixed | (255 days after) |