HashiCorp Vagrant has code injection vulnerability through default synced folders

🗓️ 02 Jul 2025 21:32:00Reported by GitHub Advisory DatabaseType

HashiCorp Vagrant has a vulnerability allowing code injection via default synced folders in VM escape.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2025-34075	2 Jul 202521:26	–	circl
CNNVD	编号撤回	2 Jul 202500:00	–	cnnvd
CVE	CVE-2025-34075	2 Jul 202519:26	–	cve
Cvelist	CVE-2025-34075	2 Jul 202519:26	–	cvelist
EUVD	EUVD-2025-19756	3 Oct 202520:07	–	euvd
Tenable Nessus	HashiCorp Vagrant 2.2.10 < 2.4.7 Code Injection (macOS)	11 Jul 202500:00	–	nessus
NVD	CVE-2025-34075	2 Jul 202520:15	–	nvd
OSV	GHSA-HQP6-MJW3-F586 HashiCorp Vagrant has code injection vulnerability through default synced folders	2 Jul 202521:32	–	osv
OSV	UBUNTU-CVE-2025-34075	2 Jul 202520:15	–	osv
Positive Technologies	PT-2025-27667 · Hashicorp · Hashicorp Vagrant	19 Jan 202100:00	–	ptsecurity

Vulners

Node

vagrant_project vagrantRange2.2.10–2.4.7rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-34075
developer	www.developer.hashicorp.com/vagrant
developer	www.developer.hashicorp.com/vagrant/docs/synced-folders/basic_usage
developer	www.developer.hashicorp.com/vagrant/docs/vagrantfile
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb
vulncheck	www.vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout
github	www.github.com/hashicorp/vagrant/issues/13688
github	www.github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3
github	www.github.com/advisories/GHSA-hqp6-mjw3-f586
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/vagrant/CVE-2025-34075.yml

05 Jul 2025 01:47Current

7.3High risk

Vulners AI Score7.3