File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

Affected Packages

PyPI salt

Affected versions: 3007.0rc1 (fixed in 3007.4)

PyPI salt

Affected versions: 3006.0rc1 (fixed in 3006.12)

Related CVEs

CVE-2025-22241

Key Information

GHSA ID

GHSA-7f3f-x5f5-79gw

Published

June 13, 2025 9:30 AM

Last Modified

June 13, 2025 9:57 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

salt

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 14, 2025 6:24 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.