CVE-2024-21542

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-10 · updated 2026-06-17
Weakness: CWE-29

Description

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

Affected products

luigi: before 3.6.0 — fixed in 3.6.0

How to fix

Upgrade to a fixed version: luigi 3.6.0. Check the vendor advisory for mitigations.

References

https://github.com/L3ster1337/Poc-CVE-2024-21542
https://github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999
https://github.com/spotify/luigi/issues/3301
https://github.com/spotify/luigi/releases/tag/v3.6.0
https://security.snyk.io/vuln/SNYK-PYTHON-LUIGI-7830489

Get alerted when CVE-2024-21542 or the next vulnerability affects your stack