CVE-2025-5459 — OS Command Injection
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Ente…
Published: 2025-06-26 · CVSS: 8.6 · CVSS 4.0
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7