high8.6
CVE-2024-21542
luigi Arbitrary File Write via Archive Extraction (Zip Slip)
Impact
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | luigi | < 3.6.0 | 3.6.0 |
Affected products
| Product | Affected versions |
|---|---|
| Package Luigi | before 3.6.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/L3ster1337/Poc-CVE-2024-21542
- https://github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999
- https://github.com/spotify/luigi/issues/3301
- https://github.com/spotify/luigi/releases/tag/v3.6.0
- https://security.snyk.io/vuln/SNYK-PYTHON-LUIGI-7830489
- https://github.com/advisories/GHSA-8qch-vj6m-2694
- https://nvd.nist.gov/vuln/detail/CVE-2024-21542
- https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2024-159.yaml