StackRadar

CVE-2026-22702

Medium

Advisory

Published 10 Jan 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.5
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
87
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
2 of 3
affected packages

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Carried by container images the latest versions of 87 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
virtualenvpypi1.11.4, 15.1.0, 16.3.0, 16.6.0+42 more20.36.1106
python-virtualenvdeb1.11.4-1ubuntu1, 20.0.17-1ubuntu0.3, 20.17.1+ds-1, 20.25.0+ds-2no fix listed9
virtualenvbitnami20.28.0, 20.31.220.36.13
OSV records
BIT-virtualenv-2026-22702DEBIAN-CVE-2026-22702GHSA-597g-3phw-6986UBUNTU-CVE-2026-22702
Also known as
PYSEC-2026-2009

Charts affected

87 by stars
ChartLatestAffected imagesRadar Score
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
virtualenv@20.17.1
20.36.1

Open the chart page →

4,085
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
virtualenv@20.15.1
20.36.1

Open the chart page →

3,892
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
virtualenv@20.30.0
20.36.1

Open the chart page →

12,958
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
virtualenv@20.35.4
20.36.1

Open the chart page →

8,923
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
virtualenv@20.28.1
20.36.1

Open the chart page →

9,096
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
virtualenv@20.29.2
20.36.1

Open the chart page →

4,647
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
20.36.1

Open the chart page →

4,293
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
virtualenv@20.17.1
20.36.1

Open the chart page →

8,685
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
virtualenv@16.6.0
20.36.1

Open the chart page →

8,221
twitch-channel-points-minerjacobcolvinVerified publisher0.1.01 of 1See more

twitch-channel-points-miner jacobcolvin 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
virtualenv@20.24.3
20.36.1

Open the chart page →

1,088
shynetjuniorjpdj0.1.301 of 1See more

shynet juniorjpdj 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
virtualenv@20.21.1
20.36.1

Open the chart page →

2,581
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
virtualenv@20.16.5
20.36.1

Open the chart page →

16,417
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
virtualenv@20.24.5
20.36.1

Open the chart page →

6,447
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
virtualenv@20.25.0
20.36.1

Open the chart page →

1,444
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
virtualenv@20.23.1
20.36.1

Open the chart page →

4,293
large-systems-djangolarge-systems-djangoVerified publisher1.0.01 of 1See more

large-systems-django large-systems-django 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ha33ona/python:test6affdfc644d0
virtualenv@20.17.1
20.36.1

Open the chart page →

3,891
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
virtualenv@20.21.1
20.36.1

Open the chart page →

1,949
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
virtualenv@20.29.1
20.36.1

Open the chart page →

5,823
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
virtualenv@20.20.0
20.36.1

Open the chart page →

5,456
automx2oleds-helm-chartsVerified publisher1.0.51 of 1See more

automx2 oleds-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
oled01/automx2:2025.1.105d3e398e675
virtualenv@20.31.2
virtualenv@20.31.2
20.36.1
20.36.1

Open the chart page →

5,288
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
openwhisk/kafkaprovider:2.1.063dc3d2a0904
virtualenv@16.7.6
20.36.1

Open the chart page →

36,215
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.05 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

5 of the 40 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
20.36.1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
20.36.1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
20.36.1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
20.36.1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
20.36.1

Open the chart page →

71,208
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
virtualenv@20.35.4
20.36.1

Open the chart page →

4,749
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
virtualenv@20.31.2
20.36.1

Open the chart page →

16,196
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
virtualenv@20.24.5
20.36.1

Open the chart page →

12,754
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
virtualenv@20.26.4
20.36.1

Open the chart page →

21,211
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
virtualenv@20.29.2
20.36.1

Open the chart page →

9,355
revwallet-apirevwallet0.7.121 of 1See more

revwallet-api revwallet 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
arthurjguerra18/revwallet:v0.7.12f540af20b307
virtualenv@20.26.3
20.36.1

Open the chart page →

5,790
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
virtualenv@20.24.3
20.36.1

Open the chart page →

4,908
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
20.36.1

Open the chart page →

9,607
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
virtualenv@20.29.3
20.36.1

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
virtualenv@20.29.3
20.36.1

Open the chart page →

4,718
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
virtualenv@20.25.0
20.36.1

Open the chart page →

10,209
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
virtualenv@20.21.1
20.36.1

Open the chart page →

5,565
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
virtualenv@20.29.3
20.36.1

Open the chart page →

7,901
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
virtualenv@20.19.0
20.36.1

Open the chart page →

1,009
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
virtualenv@15.1.0
20.36.1

Open the chart page →

3,116

Container images carrying it

106 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
20.36.1
3
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
20.36.1
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
virtualenv@20.29.3
20.36.1
2
alerta/alerta-web:8.5.04786b9eaa606
virtualenv@20.10.0
20.36.1
1
allegroai/clearml:2.0.0-613713ae38f7daf
virtualenv@20.28.0
20.36.1
1
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
virtualenv@20.15.0
20.36.1
1
apache/airflow:2.8.4-python3.964e58748b6b9
virtualenv@20.25.1
20.36.1
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
virtualenv@20.26.4
20.36.1
1
apache/airflow:2.8.1e5560ad0b86e
virtualenv@20.25.0
20.36.1
1
arthurjguerra18/revwallet:v0.7.12f540af20b307
virtualenv@20.26.3
20.36.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
virtualenv@20.35.4
20.36.1
1
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
virtualenv@20.28.0
virtualenv@20.28.0
20.36.1
20.36.1
1
bmeares/meerschaum:2.8.48e9c5bacaa82
virtualenv@20.29.1
20.36.1
1
camerahub/camerahub:0.36.23a5af37dd6e1b
virtualenv@20.21.1
20.36.1
1
cdignam/kodiak:v0.54.05a6a55b39cee
virtualenv@20.15.1
20.36.1
1
codecov/self-hosted-api:24.4.10475cb1c3136
virtualenv@20.4.3
20.36.1
1
codecov/self-hosted-worker:24.4.1837f546b479b
virtualenv@20.24.5
20.36.1
1
djjudas21/autonodelabel:0.0.6f17233350c4f
virtualenv@20.24.2
20.36.1
1
evk02/mlflow:2.2.1ef6ff257ef35
virtualenv@20.20.0
20.36.1
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
virtualenv@20.17.1
20.36.1
1
galaxy/galaxy-init:v18.010267bad550e6
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
20.36.1
1
galaxy/galaxy-stable:v18.018e577a626dfd
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
20.36.1
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-virtualenv@20.17.1+ds-1
virtualenv@20.17.1+ds
no fix listed
20.36.1
1
gethue/hue:4.11.011b649636e68
virtualenv@20.16.5
20.36.1
1
gethue/hue:4.10.05702b2c37ff9
virtualenv@20.4.7
20.36.1
1
gethue/hue:latest7d5c1b9f8a79
virtualenv@20.24.4
20.36.1
1
ha33ona/python:test6affdfc644d0
virtualenv@20.17.1
20.36.1
1
hansehe/locust:1.1.0bc8e45262bc4
virtualenv@20.29.3
20.36.1
1
hayk96/alerta-web:9.0.486377705e9e3
virtualenv@20.26.3
20.36.1
1
hhyo/archery:v1.9.11aa41843419e
virtualenv@20.15.1
20.36.1
1
hjacobs/kube-downscaler:23.2.05d328c003efe
virtualenv@20.19.0
20.36.1
1
hjacobs/kube-janitor:23.7.0fbb303ed463c
virtualenv@20.23.1
20.36.1
1
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
virtualenv@20.21.1
20.36.1
1
hjacobs/kube-resource-report:22.11.0c173cd02f5af
virtualenv@20.17.0
20.36.1
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
virtualenv@20.24.3
20.36.1
1
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
virtualenv@20.14.1
20.36.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
virtualenv@20.24.5
20.36.1
1
homeassistant/home-assistant:2023.12.48d000332b09b
virtualenv@20.25.0
20.36.1
1
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
virtualenv@16.6.0
20.36.1
1
jaedb/iris:latest048cfbf58d57
virtualenv@20.30.0
20.36.1
1
knspar/phronetis:0.1.4609499d2dc91a
virtualenv@20.31.2
20.36.1
1
kong/httpbin:latesta6ac46531193
virtualenv@20.28.1
20.36.1
1
langgenius/dify-api:1.0.0066035f93856
virtualenv@20.29.2
20.36.1
1
linuxserver/couchpotato:75e576ee-ls389cd8d5fb1ac
virtualenv@16.3.0
20.36.1
1
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
virtualenv@16.7.9
20.36.1
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
virtualenv@16.7.9
20.36.1
1
lnbitsdocker/lnbits-legend:latest26fae6327477
virtualenv@20.25.0
20.36.1
1
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
virtualenv@20.21.1
20.36.1
1
localstack/localstack:3.19d278167f2b7
virtualenv@20.25.0
20.36.1
1
milesmcc/shynet:v0.13.1ba54f7797a6b
virtualenv@20.21.1
20.36.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.