Loading HuntDB...

GHSA-fcr4-h6c4-rvvp

GitHub Security Advisory

Salt's on demand pillar functionality vulnerable to arbitrary command injections

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

Affected Packages

PyPI salt
Affected versions: 3006.0rc1 (fixed in 3006.12)
PyPI salt
Affected versions: 3007.0rc1 (fixed in 3007.4)

Related CVEs

Key Information

GHSA ID
GHSA-fcr4-h6c4-rvvp
Published
June 13, 2025 9:30 AM
Last Modified
June 13, 2025 9:19 PM
CVSS Score
5.0 /10
Primary Ecosystem
PyPI
Primary Package
salt
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 14, 2025 6:24 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.