The vulnerability of the Vagrant framework for creating and managing development environments lies in its ability to allow a hacker to download and edit the Vagrantfile file on the host virtual machine. This enables the hacker to read and modify data, as well as execute arbitrary code.

The vulnerability of the Vagrant framework for creating and managing development environments lies in the ability to load and edit the Vagrantfile file on the host virtual machine, due to the use of a default synchronized folder configuration. Exploiting this vulnerability can allow an attacker t...

Incorrect Default Permissions

Vagrant is vulnerable to Incorrect Default Permissions. The vulnerability is due to the Vagrantfile being writable from within the guest VM and executed by the host, allowing a low-privileged attacker to achieve guest-to-host code execution...

SUSE CVE-2025-34075

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host's Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does...

GHSA-HQP6-MJW3-F586 HashiCorp Vagrant has code injection vulnerability through default synced folders

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant or C:\vagrant on Windows. Thi...

HashiCorp Vagrant has code injection vulnerability through default synced folders

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant or C:\vagrant on Windows. Thi...

CVE-2025-34075

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended...

CVE-2025-34075

...

CVE-2025-34075

...

CVE-2025-34075

CVE-2025-34075 entry is labeled rejected/withdrawn by the CNA. Connected docs describe a guest-to-host code-execution vector in HashiCorp Vagrant via the default synced-folder Vagrantfile exposure: Vagrant mounts the host project directory (including Vagrantfile) into the guest, and an attacker w...

编号撤回

Vagrant and others are products of . Vagrant is a command line utility for managing the lifecycle of virtual machines. Isolates dependencies and their configurations in a single disposable and consistent environment. webSockets ws and others are products of the WebSockets open source. ws is a...

HashiCorp Vagrant has code injection vulnerability through default synced folders

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant or C:\vagrant on Windows. Thi...

CVE-2024-10228

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

CVE-2023-5834

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

CVE-2024-10228

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

Vagrant VMware Utility installation files vulnerable to modification by unprivileged user

Summary The Vagrant VMware Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMware Utility 1.0.23...

CVE-2024-10228 Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

CVE-2024-10228 Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

CVE-2024-10228 Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

CVE-2024-10228

The CVE-2024-10228 entry concerns the Vagrant VMWare Utility Windows installer, where the installer places files into a custom, non-protected path that can be modified by an unprivileged user, enabling unauthorized file-system writes. This root cause is described across multiple sources and versi...

PT-2024-16127 · Vagrant · Vagrant Vmware Utility

Name of the Vulnerable Software and Affected Versions: Vagrant VMWare Utility version 1.0.23 and earlier Description: The Vagrant VMWare Utility Windows installer has a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes...