Poc-CVE-2024-21542

Poc-CVE-2024-21542 Overview luigi is a package that helps you build complex pipelines of batch jobs. It handles dependency resolution, workflow management, visualization, handling failures, command line integration, and much more. Affected versions of this package are vulnerable to Arbitrary File...

disdat-luigi (>=1.0.1, <=1.0.2) potentially affected by unknown CVE via luigi (3.5.2)

luigi PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - disdat-luigi =1.0.1, =1.0.2 Source cves: unknown CVE Source advisory: MEND:WS-2017-0234...

aws-service-catalog-factory (>=0.4.0, <=0.101.1), aws-service-catalog-puppet (>=0.1.0, <=0.253.0) +19 more potentially affected by unknown CVE via luigi (>=2.7.8, <=3.1.1)

luigi PYPI version =2.7.8, =0.4.0, =0.1.0, =0.3.1, =0.4.0, =0.0.8, =0.40.0, =0.4.0, =0.5.0, =0.2.1, =0.3.2, =0.2.1, =0.8.0, =0.10.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2017-0234...

EUVD-2018-0087

Malware in sbrugna...

EUVD-2024-0098

Malicious code in bioql PyPI...

Why 3D-Printing an Untraceable Ghost Gun Is Easier Than Ever

On today’s episode of ‘Uncanny Valley,’ we discuss how WIRED was able to legally 3D-print the same gun allegedly used by Luigi Mangione, and where US law stands on the technology...

CVE-2018-1000843

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery CSRF vulnerability in API endpoint: /api/ that can result in Task metadata such as task name, id, parameter, etc. will be leake...

We Made Luigi Mangione’s 3D-Printed Gun—and Fired It

In the wake of Luigi Mangione’s alleged killing of a health care CEO with a partially 3D-printed pistol, we built and tested the exact same model of weapon ourselves. And it was entirely legal...

Malicious code in luigi-core-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11cd1d2cbf2a40d16c75ccb85355549f06a2ffc93d9cdacc4861e929cd70ae14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2466 Malicious code in luigi-core-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11cd1d2cbf2a40d16c75ccb85355549f06a2ffc93d9cdacc4861e929cd70ae14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

Archive Extraction Handler Luigi Code Execution

The vulnerability of the Archive Extraction Handler component in the Luigi library for the Python programming language is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using ...

aws-service-catalog-factory (>=0.102.0, <=0.102.1), aws-service-catalog-puppet (>=0.96.0, <=0.253.0) +70 more potentially affected by CVE-2024-21542 via luigi (>=3.0.0b2, <=3.5.2)

luigi PYPI version =3.0.0b2, =0.102.0, =0.96.0, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =1.2.1, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.2.3, =0.1.0, =0.1.25 and more Source cves: CVE-2024-21542 Source advisory: GHSA-8QCH-VJ6M-2694...

aws-service-catalog-factory (>=0.102.0, <=0.102.1), aws-service-catalog-puppet (>=0.96.0, <=0.253.0) +70 more potentially affected by CVE-2024-21542 via luigi (>=3.0.0b2, <=3.5.2)

luigi PYPI version =3.0.0b2, =0.102.0, =0.96.0, =0.4.0, =0.0.8, =0.40.0, =1.0.1, =0.4.0, =1.0.0a20, =1.2.1, =0.5.0, =0.0.7, =0.1.0, =0.1.0, =0.2.3, =0.1.0, =0.1.25 and more Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

mars-gym (0.1.0) potentially affected by CVE-2024-21542 via luigi (2.8.13)

luigi PYPI version 2.8.13 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - mars-gym 0.1.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-puppet (>=0.42.0, <=0.95.0) potentially affected by CVE-2024-21542 via luigi (2.8.9)

luigi PYPI version 2.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-puppet =0.42.0, =0.95.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-factory (>=0.4.0, <=0.22.1), aws-service-catalog-puppet (>=0.25.0, <=0.31.0) potentially affected by CVE-2024-21542 via luigi (2.8.7)

luigi PYPI version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.4.0, =0.25.0, =0.31.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

aws-service-catalog-factory (>=0.22.2, <=0.101.1), aws-service-catalog-puppet (>=0.1.0, <=0.41.0) potentially affected by CVE-2024-21542 via luigi (2.8.6)

luigi PYPI version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - aws-service-catalog-factory =0.22.2, =0.1.0, =0.41.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

b2luigi (>=0.3.1, <=0.5.0) potentially affected by CVE-2024-21542 via luigi (2.7.8)

luigi PYPI version 2.7.8 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - b2luigi =0.3.1, =0.5.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...

py-rate (>=0.1.2, <=0.2.0) potentially affected by CVE-2024-21542 via luigi (1.3.0)

luigi PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on luigi and may be impacted: - py-rate =0.1.2, =0.2.0 Source cves: CVE-2024-21542 Source advisory: OSV:GHSA-8QCH-VJ6M-2694...