CVE-2026-22702 is a TOCTOU (Time-of-Check-Time-of-Use) vulnerability in virtualenv affecting all versions up to 20.36.1. It allows local attackers to exploit race conditions in directory creation to perform symlink attacks, potentially leading to cache poisoning, information disclosure, lock bypass, or denial of service on multi-user systems. The issue is fixed in version 20.36.2 and later by using atomic directory creation calls.