CVE-2024-21542 is a directory traversal vulnerability in the luigi package before version 3.6.0. The issue arises from insufficient validation of file paths when extracting archive files in the _extract_packages_archive function, allowing an attacker to write files arbitrarily on the filesystem (Zip Slip). This can lead to unauthorized file modification or creation. The vulnerability has a CVSS 4.0 score of 7.7, indicating high severity. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the filesystem during archive extraction, potentially leading to unauthorized code execution, data corruption, or system compromise depending on the context in which luigi is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted archive files with vulnerable versions of luigi or implement manual validation of archive contents before extraction.