CVE-2025-62348: Salt Package Vulnerable to Code Injection via Specially Crafted YAML Payload
Summary
CVE-2025-62348: Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload. Affects salt versions < 3006.17. Fixed in 3006.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is an open-source configuration management and orchestration tool that allows users to manage and automate the deployment of software and systems. It utilizes a master-minion architecture, where commands are sent from a master server to minion clients. The Salt junos module is specifically designed for managing network devices running Junos OS. This module is widely used in network automation but has been found to contain a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
The vulnerability arises from an unsafe usage of YAML decode/load functions within the Salt junos execution module. A specially crafted YAML payload can be processed by the junos module, leading to unintended code execution within the context of the Salt process. This could allow an attacker to execute arbitrary code, potentially compromising the entire system and leading to data breaches or unauthorized access.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3006.17
This is the first release that contains the fix.
pip install --upgrade "salt==3006.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid processing untrusted YAML payloads with the junos module until the package is updated. Additionally, implementing strict input validation can help mitigate the risk of code injection.
Conclusion
The Salt package has a critical vulnerability (CVE-2025-62348) that allows for code injection via specially crafted YAML payloads. It is crucial to update to version 3006.17 or later to mitigate this risk. Users should also consider temporary workarounds until they can apply the necessary updates.
See every vulnerability recorded for salt →
FAQ
CVE-2025-62348 is a vulnerability in the Salt package that allows for code injection through specially crafted YAML payloads.
If exploited, this vulnerability can lead to arbitrary code execution, potentially compromising your system and data.
All versions of Salt prior to 3006.17 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid processing untrusted YAML payloads and implement strict input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
