CVE-2013-4438: SaltStack Salt

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.

Affected products

• SaltStack Salt: up to and including 0.17.0; version 0.6.0 only; version 0.7.0 only; version 0.8.0 only; version 0.8.7 only; version 0.8.8 only; …

Published 2013-11-05. Last modified 2026-06-16.