What’s Vulnerable › Vulnerabilities

CVE-2021-33226

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-17 · updated 2026-06-17
• Weakness: CWE-120

Description

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input

Affected products

• VMware SALT: through 3003

References

• https://bugzilla.suse.com/show_bug.cgi?id=1208473
• https://github.com/saltstack/salt/blob/master/salt/modules/status.py
• https://bugzilla.suse.com/show_bug.cgi?id=1208473
• https://github.com/saltstack/salt/blob/master/salt/modules/status.py

Get alerted when CVE-2021-33226 or the next vulnerability affects your stack