PT-2023-12841 · Unknown · Vagrant.Js

Name of the Vulnerable Software and Affected Versions: vagrant.js versions all Description: The issue arises from improper input sanitization in the boxAdd function, leading to Command Injection. This allows for potential execution of arbitrary commands. Recommendations: For all versions, conside...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. PoC js vagrant = require"vagrant.js"; vagrant.boxAdd";touch EXPLOITED;", "", functionboxArr, stderr; Remediation There is no fixed version for vagrant.js...