8.6
High
CVE-2024-21542 Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip)…
Description
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| luigi 3.6 | earliest → < 3.6.0 | 3.6.0 |