heist-salt (>=1.0.0 <=5.3.1), isalt (>=2019.12.0 <=2021.2.2) +9 more potentially affected by CVE-2025-22240 via salt (=3007.14.0)

salt PYPI version =3007.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on salt and may be impacted: - heist-salt =1.0.0, =2019.12.0, =2019.6.28a3, =2.6.2.dev0, =2020.7.0, =1.1.1, =22.9.8.0rc1, =0.3.2, =0.5.7 - slskit =2022.4.0 Source cves:...

Information Disclosure

salt is vulnerable to information disclosure. The library displays the password of a newly created user in plaintext to the user that just created a new user account...

Remote Code Execution (RCE)

salt is vulnerable to remote code execution RCE. The library does not clear messages on the minion, meaning a malicious user can conduct a Man-in-the-Middle MitM attack to execute arbitrary code by inserting packets into the datastream...