CVE-2025-5459

OS Command Injection

High8.6EPSS 1.1%

Published: 26 Jun 2025
Updated: 4 Sept 2026
Reserved: 2 Jun 2025
Assigned by: Perforce

Description

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

Scores

CVSS scores of CVE-2025-5459, by who scored it
Scored by	CVSS	Score	Vector
PerforceCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Modified	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.1% · top 34% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Perforce · Puppet Enterprise
- affected 2018.1.8 – ≤ 2023.8.3, 2025.3

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-5459](https://trackcve.app/badge/CVE-2025-5459.svg)](https://trackcve.app/cve/CVE-2025-5459)

Record last updated 4 Sept 2026, 01:16 UTC.