CVE-2025-62348: Salt Package Vulnerable to Code Injection via Unsafe YAML Processing
Summary
CVE-2025-62348: Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload. Affects salt versions < 3006.17. Fixed in 3006.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is an open-source configuration management and orchestration tool that allows users to manage and automate the deployment of software and infrastructure. It utilizes a master-minion architecture, where commands are sent from a master server to minion nodes. The Salt junos module is specifically designed to interact with Juniper devices, enabling users to execute commands and manage configurations. However, a vulnerability in this module has been identified, which could lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability arises from an unsafe usage of YAML decoding in Salt's junos execution module. A specially crafted YAML payload can be processed by the module, leading to unintended code execution within the context of the Salt process. This could allow an attacker to execute arbitrary code, potentially compromising the entire system where Salt is running. The vulnerability is classified under CWE-94 (Code Injection) and has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3006.17
This is the first release that contains the fix.
pip install --upgrade "salt==3006.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted YAML payloads with the junos module until the package is updated. It is crucial to validate and sanitize any input that may be processed by the module to prevent potential code injection attacks.
Conclusion
The vulnerability identified in Salt's junos module poses a serious risk due to its potential for code injection through unsafe YAML processing. It is crucial for users to update to the patched version to protect their systems from exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for salt →
FAQ
The vulnerability allows for code injection through unsafe YAML processing, which can lead to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Update the Salt package to version 3006.17 or later to mitigate the risk associated with this vulnerability.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
While specific exploits may not be publicly available, the nature of the vulnerability poses a significant risk if left unaddressed.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
