CVE-2021-3197

CVE-2021-3197 is a critical shell injection vulnerability affecting SaltStack Salt versions prior to 3002.5, specifically impacting the salt-api's SSH client. An unauthenticated attacker can exploit this by injecting ProxyCommand into an argument or via ssh_options in an API request, leading to arbitrary command execution. With a CVSS score of 9.8, this vulnerability poses a severe risk of complete compromise (confidentiality, integrity, and availability) due to its network-based attack vector and low attack complexity. While no active exploitation, public exploit code, or significant community discussion has been observed, the high FAUCET Risk Score of 89/100 indicates its potential for severe impact if exploited.