CVE-2025-22239: Salt vulnerable to arbitrary event injection

June 13, 2025

Arbitrary event injection on Salt Master. The master’s “_minion_event” method can be used by and authorized minion to send arbitrary events onto the master’s event bus.

References

docs.saltproject.io/en/3006/topics/releases/3006.12.html
docs.saltproject.io/en/3007/topics/releases/3007.4.html
github.com/advisories/GHSA-c46w-gr7f-jm2p
github.com/saltstack/salt
github.com/saltstack/salt/commit/41d834bf800d86fc496e4fac2d3875fc2aca7c62
nvd.nist.gov/vuln/detail/CVE-2025-22239

Code Behaviors & Features

Detect and mitigate CVE-2025-22239 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →