GHSA-8qch-vj6m-2694

luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Source: GitHub Advisory Database (reviewed) High CVE-2024-21542

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	luigi	< 3.6.0	3.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

References

External links from the advisory. They lead to third-party sites.

Dates

Published: 2024-12-10
Modified: 2025-02-11
Reviewed: 2024-12-10

Severity

8.6 CVSS 3 base score, computed from the vector

GitHub rating: High
CVSS 3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

Source

From the GitHub Advisory Database, licensed CC-BY 4.0; reformatted here (ranges summarised, score computed).