CVE-2025-62348: 
Python vulnerability analysis and mitigation

CVE-2025-62348 is a code injection vulnerability in SaltStack's junos execution module caused by unsafe YAML deserialization. A specially crafted YAML payload processed by the junos module can lead to unintended code execution under the context of the Salt process. Affected versions include Salt < 3006.17 and 3007.0 < 3007.9. The vulnerability was published on January 30, 2026, with a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, Red Hat).

The root cause is the use of an unsafe YAML load() or equivalent deserialization function in Salt's junos execution module, classified under CWE-94 (Improper Control of Generation of Code) and CWE-502 (Deserialization of Untrusted Data). Python's yaml.load() without a safe loader allows arbitrary Python object instantiation, enabling code execution when processing attacker-controlled YAML input. Exploitation requires local access with low privileges and the presence of specific deployment conditions (Attack Requirements: Present), meaning the junos module must be active and processing attacker-influenced YAML data. The fix is tracked in the Salt project repository at commit c17fd64 and issue #68469 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local, low-privileged attacker to execute arbitrary code within the context of the Salt process, resulting in high confidentiality, integrity, and availability impacts on the vulnerable system. An attacker could read sensitive configuration data managed by Salt, modify system state, or disrupt Salt's availability. Because Salt is commonly used as an infrastructure automation and orchestration platform, compromise of the Salt process could facilitate lateral movement to managed minions or other infrastructure components (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (1st percentile), indicating a low near-term probability of exploitation. No threat actor attribution has been reported.

1. Gain local access: Obtain a local account with low privileges on a system running a vulnerable version of Salt (< 3006.17 or 3007.0 < 3007.9) with the junos execution module active.
2. Identify the junos module: Confirm the junos execution module is enabled and accessible, as it must be processing YAML input for the vulnerability to be triggered.
3. Craft a malicious YAML payload: Construct a YAML payload exploiting Python's unsafe yaml.load() deserialization, such as using PyYAML's !!python/object/apply tag to invoke arbitrary Python callables (e.g., !!python/object/apply:os.system ['id']).
4. Deliver the payload: Supply the crafted YAML to the junos module through any interface that allows a low-privileged user to pass input to the module (e.g., Salt CLI, API call, or crafted state/pillar data).
5. Achieve code execution: The unsafe YAML loader deserializes the payload and executes the embedded code within the Salt process context, granting the attacker the privileges of the Salt process (GitHub Advisory, Red Hat Bugzilla).

• Logs: Unexpected or anomalous Salt process log entries related to the junos execution module; errors or tracebacks from YAML parsing in Salt logs (/var/log/salt/master or /var/log/salt/minion).
• Process: Unusual child processes spawned by the Salt master or minion process (e.g., sh, bash, python, curl, wget) that are not part of normal Salt operations.
• File System: Unexpected files created in Salt working directories or temporary directories by the Salt process user; new cron jobs, scripts, or binaries owned by the Salt service account.
• Network: Unexpected outbound network connections originating from the Salt process to unknown external hosts, potentially indicating reverse shell or data exfiltration activity.

Salt Project has released patched versions: 3006.17 and 3007.9, which replace the unsafe YAML loader with a safe alternative in the junos execution module (GitHub Advisory, Salt Release Notes). Organizations unable to upgrade immediately should disable the junos execution module if it is not required, restrict local access to Salt systems, and apply the principle of least privilege to limit which users can invoke Salt modules. Input validation and sanitization of YAML payloads processed by Salt should also be enforced as a defense-in-depth measure.

SUSE issued security advisories addressing CVE-2025-62348 in their Linux Manager and Salt packages, indicating downstream Linux distribution vendors have prioritized patching (Linux Security). Red Hat tracked the issue via Bugzilla and assigned it a high severity rating (Red Hat Bugzilla). Tenable added detection plugins for the vulnerability across multiple Nessus plugin IDs. No significant social media controversy or notable researcher commentary beyond standard advisory coverage has been observed.