CVE-2024-21542 is a directory traversal vulnerability in the luigi package before version 3.6.0. It arises from insufficient validation of file paths during archive extraction in the _extract_packages_archive function, enabling an attacker to perform arbitrary file writes (Zip Slip). This can lead to overwriting critical files or placing malicious files in sensitive locations. The vulnerability is rated high severity with a CVSS 4.0 score of 7.7, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high scope impact. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed.

Successful exploitation allows an attacker to write files to arbitrary locations on the affected system, potentially leading to code execution, system compromise, or disruption of service depending on the files overwritten. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid extracting untrusted archives with vulnerable versions of luigi or implement manual path validation to prevent directory traversal during archive extraction.