CVE-2021-33226

9.8 criticalEPSS 1.6%

Critical (9.8) in saltstack salt. EPSS 1.6% chance of exploitation in the next 30 days. Fixed in salt 3003.1.

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-120
Published: 2023-02-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

saltstack:salt

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
PYSEC-2023-47	PyPI	salt	<3003.1	3003.1

References

https://bugzilla.suse.com/show_bug.cgi?id=1208473
https://github.com/saltstack/salt/blob/master/salt/modules/status.py
https://bugzilla.suse.com/show_bug.cgi?id=1208473
https://github.com/saltstack/salt/blob/master/salt/modules/status.py

Check your stack JSON