{"action":"Upgrade luigi to 3.6.0 or later.","affected":[{"fixed":"3.6.0","introduced":"0"}],"component":"luigi","cve_ids":["CVE-2024-21542"],"ecosystem":"PyPI","epss":0.01135,"exploited":false,"fixed_versions":["3.6.0"],"ghsa_id":"GHSA-8qch-vj6m-2694","id":"tcs_01M5KF8VR0D6318C57G97QD7FT","modified_at":"2025-02-11T00:57:17.596021Z","published_at":"2024-12-10T06:31:40Z","references":["https://osv.dev/vulnerability/GHSA-8qch-vj6m-2694","https://nvd.nist.gov/vuln/detail/CVE-2024-21542","https://github.com/spotify/luigi/issues/3301","https://github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999","https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2024-159.yaml","https://github.com/spotify/luigi","https://github.com/spotify/luigi/releases/tag/v3.6.0","https://security.snyk.io/vuln/SNYK-PYTHON-LUIGI-7830489"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-8qch-vj6m-2694","url":"https://osv.dev/vulnerability/GHSA-8qch-vj6m-2694"}],"summary":"luigi Arbitrary File Write via Archive Extraction (Zip Slip)"}