{"id":"CVE-2023-34049","aliases":["GHSA-4277-m35q-7c9w","PYSEC-2026-1892"],"title":"Salt preflight script could be attacker controlled","summary":"Salt preflight script could be attacker controlled","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","vendor":"salt","product":"salt","ecosystem":"pip","affected":["salt < 3005.4","salt >= 3006.0rc1, < 3006.4"],"patched":["salt 3005.4","salt 3006.4"],"published":"2024-11-14","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4277-m35q-7c9w","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34049"},{"url":"https://github.com/saltstack/salt/commit/286d55eb5a6e6bf9428405bdf5632b419bdf8444"},{"url":"https://github.com/saltstack/salt/commit/7a14112f2a16ce70e3c3e1862c92e37af5f2c7a4"},{"url":"https://github.com/saltstack/salt"},{"url":"https://saltproject.io/security-announcements/2023-10-27-advisory"}],"tags":["osv","pip"],"epss":0.00187,"epssPercentile":0.08571,"ingestedAt":"2026-07-08T18:25:45.221Z","slug":"CVE-2023-34049","body":"## Overview\n\nThe Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.\n\n## Affected packages\n\n- `salt < 3005.4`\n- `salt >= 3006.0rc1, < 3006.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `salt 3005.4`\n- `salt 3006.4`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}