PyPI: salt
CVE-2025-22237
Safety vulnerability ID: SFTY-20250620-48483
Safety legacy ID: pyup.io-77732
Affected versions of this package are vulnerable to Command Injection due to insufficient input validation in the on-demand pillar functionality. The pillar processing system fails to properly sanitize Git URL inputs provided by minions when dynamically fetching external pillar data, leading to arbitrary command execution on the Salt Master. An attacker with access to a minion key can exploit this vulnerability by crafting malicious Git URLs containing command injection payloads that are executed when the master processes the on-demand pillar request.
Overview
Salt's on demand pillar functionality vulnerable to arbitrary command injections
Advisory
Affected versions of this package are vulnerable to Command Injection due to insufficient input validation in the on-demand pillar functionality. The pillar processing system fails to properly sanitize Git URL inputs provided by minions when dynamically fetching external pillar data, leading to arbitrary command execution on the Salt Master. An attacker with access to a minion key can exploit this vulnerability by crafting malicious Git URLs containing command injection payloads that are executed when the master processes the on-demand pillar request.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250620-48483/CVE-2025-22237
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22237
- https://github.com/advisories/GHSA-fcr4-h6c4-rvvp
- https://github.com/saltstack/salt/commit/9445f496fed61b15dc4364818007e5b765b0746f
- https://nvd.nist.gov/vuln/detail/CVE-2025-22237
- https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
- https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
- https://github.com/saltstack/salt/commit/9445f496fed61b15dc4364818007e5b765b0746f
- https://github.com/advisories/GHSA-fcr4-h6c4-rvvp
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more