Arbitrary Command Execution Vulnerability in SaltStack by Salt Project

CVE-2025-22237

What is CVE-2025-22237?

An exploitable vulnerability exists in SaltStack where an attacker, holding a legitimate minion key, can manipulate the 'on demand' pillar functionality. By issuing a specially crafted Git URL, the attacker can trigger arbitrary command execution on the master server. This exploit operates under the privileges of the master process, potentially leading to severe security implications.

References