CVE-2021-3197

—

CVSS 3.1

9.8 critical

EPSS

72%p99

Published

Feb 27, 2021 (Feb 27, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

Vendors: saltstack fedoraproject debian
Products: salt, fedora, debian linux
Weakness: CWE-74
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (72.3%)

In the news0 stories

No ingested article mentions this CVE yet.