CVE-2022-25962

All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization...

CVE-2022-25962

CVE-2022-25962 affects the JavaScript package vagrant.js. The root cause is improper input sanitization in the boxAdd function, enabling Command Injection. Public references include a PoC demonstrating execution of arbitrary commands, and multiple feeds (e.g., Snyk) indicate there is no fixed ver...