{"action":"Upgrade salt to 2019.2.1 or later.","affected":[{"fixed":"2019.2.1","introduced":"0"}],"component":"salt","cve_ids":["CVE-2019-17361"],"ecosystem":"PyPI","epss":0.1516,"exploited":false,"fixed_versions":["2019.2.1"],"ghsa_id":"GHSA-q53j-p6r2-g2v4","id":"tcs_01M5KG9PRHG9YMN3PQ4CH5883C","modified_at":"2026-06-10T17:02:38.485784122Z","published_at":"2020-01-17T02:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-177","https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix","https://github.com/saltstack/salt/commits/master","http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html","https://www.debian.org/security/2020/dsa-4676","https://usn.ubuntu.com/4459-1/","https://github.com/advisories/GHSA-q53j-p6r2-g2v4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-177","url":"https://osv.dev/vulnerability/PYSEC-2020-177"}],"summary":"In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint"}