Salt's on demand pillar functionality vulnerable to arbitrary command injections

MEDIUM 6.7CVE-2025-22237 · GHSA-fcr4-h6c4-rvvp · PYSEC-2026-1898 · Published 13/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
salt PyPI	`≥ 3006.0rc1, < 3006.12≥ 3007.0rc1, < 3007.4`	`3006.123007.4`

Description

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-22237 · ADVISORY
saltstack/salt commit 9445f49 · WEB
docs.saltproject.io/en/3006/topics/releases/3006.12.html · WEB
docs.saltproject.io/en/3007/topics/releases/3007.4.html · WEB
saltstack/salt · PACKAGE
pypi.org/project/salt · PACKAGE
GitHub Advisory GHSA-fcr4-h6c4-rvvp · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free