luigiGHSA-8qch-vj6m-2694
luigi Arbitrary File Write via Archive Extraction (Zip Slip)
High8.6CVE-2024-21542 · Published Dec 10, 2024 · updated Feb 11, 2025
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| luigi PyPI | < 3.6.0 | 3.6.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22, CWE-29
- Also known as
- CVE-2024-21542, PYSEC-2024-159
- nvd.nist.gov/vuln/detail/CVE-2024-21542
- github.com/spotify/luigi/issues/3301
- github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999
- github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2024-159.yaml
- github.com/spotify/luigi
- github.com/spotify/luigi/releases/tag/v3.6.0
- security.snyk.io/vuln/SNYK-PYTHON-LUIGI-7830489
More luigi advisories
All luigi| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 202018 | Cross-Site Request Forgery (CSRF) in Luigi High8.8Dec 20, 2018 | High8.8 | 2.8.0 |