AIKIDO-2024-10516

TL;DR

Affected versions of this package set overly permissive file permissions in luigi/lock.py, setting the file permissions of the pid_dir directory to 0o777 in the acquire_for function. On POSIX systems, file permissions should be strictly limited to prevent unauthorized access by other users. However, these permissive settings allow others to access the file's contents, creating a potential security risk. This issue could also be exploited to write or execute malicious code, potentially leading to privilege escalation.