GHSA-fcr4-h6c4-rvvp

Salt's on demand pillar functionality vulnerable to arbitrary command injections

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-22237

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	>= 3006.0rc1, < 3006.12	3006.12
PyPI	salt	>= 3007.0rc1, < 3007.4	3007.4

Details

As written in the advisory (Markdown source, shown as plain text).

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-22237 advisory
https://github.com/saltstack/salt/commit/9445f496fed61b15dc4364818007e5b765b0746f web
https://docs.saltproject.io/en/3006/topics/releases/3006.12.html web
https://docs.saltproject.io/en/3007/topics/releases/3007.4.html web
https://github.com/saltstack/salt package