Skip to content
Sign in
6.7 Medium

CVE-2025-22237 An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git…

Description

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

Affected products and versions

Product Affected versions Fixed in
SALT 3007 3007.x → < 3007.4 3007.4
SALT 3006 3006.x → < 3006.12 3006.12

Other CVEs of SALT

The 11 CVEs of SALT →
CVE-2024-38824 Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory 9.6 Critical CVE-2025-22242 Worker process denial of service through file read operation 5.6 Medium CVE-2025-22241 File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated… 5.6 Medium CVE-2025-22240 Arbitrary directory creation or file deletion 6.3 Medium
Track this CVE