GHSA-8qch-vj6m-2694

Source

https://github.com/advisories/GHSA-8qch-vj6m-2694

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-8qch-vj6m-2694/GHSA-8qch-vj6m-2694.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8qch-vj6m-2694

Aliases

Published

2024-12-10T06:31:40Z

Modified

2025-02-11T00:42:06Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Details

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

Database specific

{
    "cwe_ids":  [
        "CWE-22",
        "CWE-29"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-12-10T17:02:23Z",
    "nvd_published_at":  "2024-12-10T05:15:07Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / luigi

Package

Name: luigi; View open source insights on deps.dev
Purl: pkg:pypi/luigi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.6.0

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

1.1.0

1.1.1

1.1.2

1.2.1

1.3.0

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.2.0

2.3.0

2.3.1

2.3.2

2.3.3

2.4.0

2.5.0

2.6.0

2.6.1

2.6.2

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.7.8

2.7.9

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.8.7

2.8.8

2.8.9

2.8.10

2.8.11

2.8.12

2.8.13

3.*

3.0.0b1

3.0.0b2

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.4.0

3.5.0

3.5.1

3.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-8qch-vj6m-2694/GHSA-8qch-vj6m-2694.json"