A flaw in pip causes it to treat console_scripts and gui_scripts entry points as file paths rather than file names, and it does not sanitize the resolved absolute path to the installation directory. As a result, script wrappers can be installed outside the intended directory, allowing an attacker to overwrite arbitrary files. This path‑traversal weakness, identified as CWE‑22, can overwrite arbitrary files on the system, compromising integrity, potentially availability, and in some scenarios enabling arbitrary code execution.

All installations of pip prior to the fix that includes commit 8eb178480bd1a2b223f509fc430796b265158dfb are vulnerable. The vulnerability is relevant to any system that relies on pip to install third‑party wheels from unverified or insecure sources, regardless of the underlying operating system or Python version, as long as pip is used without additional safeguards.

The CVSS score of 4.1 places the issue in the medium‑severity category. EPSS data is not available, so the precise likelihood of exploitation remains unknown, but the attack surface is network‑accessible through social engineering or malicious package authors. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploitation yet. Nonetheless, the ability to overwrite critical system files and potentially trigger code execution makes the risk significant and demands prompt action.