CVE-2024-21542

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-29 CWE-22

Affected software

Vendor	Product	Versions
n/a	luigi	< 3.6.0

References

Timeline

Published: Dec 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-215437.1Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because CVE-2024-215448.6Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-215458.2Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against mali CVE-2024-215469.8Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety CVE-2024-215477.5Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where CVE-2024-215487.5Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An atta CVE-2024-215498.6Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-21554.3A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown pr CVE-2024-215506.1SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser CVE-2024-215529.8All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the CVE-2024-21569.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-215718.1Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to exec