VYPR
← All advisories
Critical severityNVD Advisory· Published Feb 27, 2021· Updated Aug 3, 2024

CVE-2021-25283

CVE-2021-25283

Description

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SaltStack Salt before 3002.5 allows server-side template injection in the Jinja renderer, leading to remote code execution.

Vulnerability

CVE-2021-25283 is a server-side template injection (SSTI) vulnerability in the Jinja renderer component of SaltStack Salt before version 3002.5 [1]. The Jinja renderer does not properly sandbox or sanitize user-controlled templates, allowing an attacker to inject arbitrary Jinja template code [1]. This is a classic SSTI flaw where the template engine evaluates expressions without proper context isolation.

Exploitation

An attacker with the ability to control a template's content—whether through pillar data, grain values, or other SLS file inputs—can craft a malicious Jinja expression [1][4]. The attack requires some degree of access to the Salt master or minion, such as being able to modify state files or set pillar/grain values. No special authentication is needed beyond what is required to submit those inputs [4].

Impact

Successful exploitation allows the attacker to execute arbitrary Python code on the Salt master or minion that processes the injected template [1]. This can lead to full compromise of the affected Salt infrastructure, including privilege escalation, data exfiltration, and lateral movement [1][3]. The severity is reflected in a high CVSS score.

Mitigation

The vulnerability is fixed in Salt version 3002.5 and later [1][2]. Users should upgrade immediately. There is no workaround other than restricting template input sources and updating to the patched version.

References
  1. NVD - CVE-2021-25283
  2. Releases · saltstack/salt
  3. GitHub - saltstack/salt: Software to automate the management and configuration of infrastructure and applications at scale.
  4. advisory-database/vulns/salt/PYSEC-2021-52.yaml at main · pypa/advisory-database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 2015.8.132015.8.13
saltPyPI
>= 2016.3.0, < 2016.11.52016.11.5
saltPyPI
>= 2016.11.7, < 2016.11.102016.11.10
saltPyPI
>= 2017.5.0, < 2017.7.82017.7.8
saltPyPI
>= 2018.2.0, <= 2018.3.5—
saltPyPI
>= 2019.2.0, < 2019.2.82019.2.8
saltPyPI
>= 3000, < 3000.73000.7
saltPyPI
>= 3001, < 3001.53001.5
saltPyPI
>= 3002, < 3002.53002.5

Affected products

32

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.