Most recent entries from all

bdu:2025-08055

fkie_cve-2025-34075

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does not violate a claimed security boundary. https://developer.hashicorp.com/vagrant/docs/synced-folders

GHSA-hqp6-mjw3-f586 — HashiCorp Vagrant has code injection vulnerability through default synced folders

Affected: RubyGems: vagrant

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges.

While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.

Withdrawn: UBUNTU-CVE-2025-34075

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: vagrant, Ubuntu:Pro:18.04:LTS: vagrant, Ubuntu:Pro:20.04:LTS: vagrant, Ubuntu:22.04:LTS: vagrant

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

WID-SEC-W-2025-1453 — Hashicorp Vagrant: Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Hashicorp Vagrant ausnutzen, um beliebigen Programmcode auszuführen.