The vulnerability in pip arises because it treats console_scripts and gui_scripts entry points as paths without sanitizing the resolved absolute path, enabling directory traversal or use of absolute paths. This allows an attacker to cause pip to write script wrappers outside the intended installation directory, resulting in arbitrary file overwrite. Exploitation requires convincing a user to install a malicious Python wheel with crafted entry-point names. The impact ranges from file overwrite to potential arbitrary code execution, especially when pip is run with elevated privileges. The issue is tracked as CWE-22 and has a CVSS score of 4.1 (medium severity).

An attacker can overwrite arbitrary files on the system with the permissions of the user running pip. When pip is used with elevated privileges (e.g., sudo), this can lead to system integrity compromise and potentially arbitrary code execution. The vulnerability affects system availability, confidentiality, and integrity by allowing unauthorized file modification and possible execution of malicious code.

Users should avoid installing Python wheels from untrusted sources and should not run 'pip install' with elevated privileges. Administrators are advised to inspect the 'entry_points.txt' file within wheels for path separators or absolute paths before installation. A fix is available as indicated by the Red Hat advisory and related patches; users should apply the official updates provided by their vendor. Patch status is confirmed by Red Hat's advisory and the referenced GitHub commit.