-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the salt-api NET API's SSH client improperly handling user input when constructing commands. The '_prep_ssh' function in Salt's SSH client is responsible for building the command string, and lack of input sanitization here allows injection. The SaltSSH.run endpoint in the REST API layer accepts unvalidated input and passes it to vulnerable SSH command execution logic. Both functions are critical points where user input flows into command execution without adequate safeguards, matching the CWE-77 command injection pattern described in the advisory.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2019.2.3 | 2019.2.3 |
Ongoing coverage of React2Shell