CVE-2025-5459 — OS Command Injection

CVE-2025-5459

OS Command Injection PUBLISHED

Description (CNA)

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

Affected (CNA)

Vendor / product	Versions
Perforce / Puppet Enterprise	affected 2018.1.8 through 2023.8.3, 2025.3

CWE

CWE-78

References

https://portal.perforce.com/s/detail/a91PA000001SiDdYAK

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2026/Sep/9