GHSA-fcr4-h6c4-rvvp
GitHub Security Advisory
Salt's on demand pillar functionality vulnerable to arbitrary command injections
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
Affected Packages
PyPI
salt
Affected versions:
3006.0rc1
(fixed in 3006.12)
PyPI
salt
Affected versions:
3007.0rc1
(fixed in 3007.4)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: June 14, 2025 6:24 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.