CVE-2025-22237: Salt's on demand pillar functionality vulnerable to arbitrary command injections

June 13, 2025

An attacker with access to a minion key can exploit the ‘on demand’ pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

References

docs.saltproject.io/en/3006/topics/releases/3006.12.html
docs.saltproject.io/en/3007/topics/releases/3007.4.html
github.com/advisories/GHSA-fcr4-h6c4-rvvp
github.com/saltstack/salt
github.com/saltstack/salt/commit/9445f496fed61b15dc4364818007e5b765b0746f
nvd.nist.gov/vuln/detail/CVE-2025-22237

Code Behaviors & Features

Detect and mitigate CVE-2025-22237 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →