HashiCorp Vagrant has code injection vulnerability through default synced folders

published 2025-07-02 last yr. modified 2025-07-05 last yr. also CVE-2025-34075

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges.

While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.

Patch / fix

fixed in 1 links 1

rubygems vagrant 2.4.7

github.com/hashicorp/vagrant@abe87b2 commit

Is GHSA-hqp6-mjw3-f586 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
rubygems	vagrant	>=2.2.10, <2.4.7	2.4.7

Classification

Weakness

CWE-276 Incorrect Default Permissions
CWE-668 Exposure of Resource to Wrong Sphere
CWE-94 Improper Control of Generation of Code

References

Sources

GitHub Advisory GHSA-hqp6-mjw3-f586

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.