Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
Date: 2026-01
Affected: pip/salt
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-62348
CWE: CWE-94
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.


Mitigations:

Architectural layers (MAESTRO):