A TOCTOU (Time-of-Check-Time-of-Use) vulnerability exists in virtualenv up to version 20.36.1, allowing local attackers to exploit race conditions in directory creation. This can lead to symlink attacks on app_data and lock file operations, enabling cache poisoning, information disclosure, lock bypass, or denial of service on multi-user systems. The issue is fixed in version 20.36.2 by using atomic directory creation calls.