This vulnerability in pip involves improper limitation of pathname to a restricted directory (CWE-22), enabling a remote attacker to exploit path traversal by delivering a crafted wheel archive. When a user installs such a malicious wheel, files may be extracted outside the intended directory, potentially disclosing sensitive information. However, the traversal is constrained to subdirectories within the installation directory, mitigating risks of executable file overwrites. Red Hat classifies this as a low-impact flaw with confidentiality and integrity impacts but no availability impact. No mitigation or patch meeting Red Hat's standards is currently provided.

The vulnerability allows limited information disclosure by extracting files outside the intended installation directory during wheel installation. The traversal is restricted to prefixes of the installation directory, preventing overwriting or injection of executable files in typical Red Hat environments. There is no known exploitation in the wild. The impact is low, affecting confidentiality and integrity but not availability.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. Until a fix is available, caution is advised when installing wheel archives from untrusted sources.