CVE-2025-5459 is a high-severity command injection vulnerability in Puppet Enterprise. A user with specific node group editing permissions can exploit a specially crafted class parameter to execute commands as root on the primary host. This affects Puppet Enterprise versions from 2018.1.8 through 2023.8.3 and 2025.3. The issue has been resolved in versions 2023.8.4 and 2025.4.0.