When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesnt implement PEP 706. Note that upgrading pip to a fixed version for this vulnerability doesnt fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.
Note that this is a vulnerability in pips fallback implementation of tar extraction for Python versions that dont implement PEP 706 and therefore are not secure to all vulnerabilities in the Python tarfile module. If youre using a Python version that implements PEP 706 then pip doesnt use the vulnerable fallback code.
Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.