CVE-2025-34075
Published Jul 2, 2025
CVSS n/a
EPSS n/a
KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does not violate a claimed security boundary. https://developer.hashicorp.com/vagrant/docs/synced-folders
Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does not violate a claimed security boundary. https://developer.hashicorp.com/vagrant/docs/synced-folders
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-19756 | HashiCorp Vagrant has code injection vulnerability through default synced folders |
 Github GHSA |
GHSA-hqp6-mjw3-f586 | HashiCorp Vagrant has code injection vulnerability through default synced folders |
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Jul 16, 2025 1:30 PM
Description updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host’s Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does not violate a claimed security boundary. https://developer.hashicorp.com/vagrant/docs/synced-folders |
| Metrics |
epss
|
Jul 10, 2025 1:30 AM
Weaknesses updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-276 CWE-668 CWE-94 |
|
| References |
|
|
| Metrics |
cvssV4_0
|
Jul 10, 2025 1:15 AM
Title updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | HashiCorp Vagrant Synced Folder Vagrantfile Breakout Host Code Execution | |
| Metrics |
ssvc
|
Jul 10, 2025 12:45 AM
Description updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| Metrics |
cvssV4_0
|
cvssV4_0
|
Jul 2, 2025 9:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Jul 2, 2025 7:30 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. | |
| Title | HashiCorp Vagrant Synced Folder Vagrantfile Breakout Host Code Execution | |
| Weaknesses | CWE-276 CWE-668 CWE-94 |
|
| References |
|
|
| Metrics |
cvssV4_0
|
Weaknesses
No weakness.
