{"action":"Upgrade luigi to 2.8.0 or later.","affected":[{"fixed":"2.8.0","introduced":"0"}],"component":"luigi","cve_ids":["CVE-2018-1000843"],"ecosystem":"PyPI","epss":0.00807,"exploited":false,"fixed_versions":["2.8.0"],"ghsa_id":"GHSA-p69g-f978-xxv9","id":"tcs_01M5KFSF9MTVAV8TGKSY5N2NE8","modified_at":"2024-09-30T17:01:01.119720Z","published_at":"2018-12-20T22:01:39Z","references":["https://osv.dev/vulnerability/GHSA-p69g-f978-xxv9","https://nvd.nist.gov/vuln/detail/CVE-2018-1000843","https://github.com/spotify/luigi/pull/1870","https://github.com/advisories/GHSA-p69g-f978-xxv9","https://github.com/pypa/advisory-database/tree/main/vulns/luigi/PYSEC-2018-11.yaml","https://github.com/spotify/luigi","https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67","https://groups.google.com/forum/#!topic/luigi-user/ZgfRTpBsVUY"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-p69g-f978-xxv9","url":"https://osv.dev/vulnerability/GHSA-p69g-f978-xxv9"}],"summary":"Cross-Site Request Forgery (CSRF) in Luigi"}