TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in directory creation have been fixed to prevent symlink-based attacks.

Two check-then-act patterns in the codebase could be exploited by an attacker with local access:

1. src/virtualenv/app_data/__init__.py:39-41 checks if the app_data directory exists with os.path.isdir(), then creates it with os.makedirs(). An attacker could create a symlink at the target path between the check and creation, causing virtualenv to write cache files (wheels, Python metadata) to an attacker-controlled location.

2. src/virtualenv/util/lock.py:19-22 has the same pattern when creating parent directories for lock files. When combined with the first vulnerability, this could allow an attacker to control lock file semantics and bypass concurrent access protections, enabling cache poisoning, information disclosure, lock bypass, and denial of service attacks.

The fix replaces both check-then-act patterns with atomic os.makedirs(..., exist_ok=True) operations. This is atomic at the OS level and eliminates the TOCTOU window, preventing symlink following attacks while maintaining backward compatibility.

Reported by: @tsigouris007