vagrant
Vagrant is a tool for building and distributing virtualized development environments.
View on Github
Activity
- Latest release
- 1y ago
- Total releases
- 71
- Cadence
- ~11 days
- Last 12 months
- 0
Reach
- Stars
- —
Details
- License
- BUSL-1.1
- First release
- Mar 07, 2010
| Version | Released | |
|---|---|---|
2.4.9
patch
|
2.4.9
patch
Dependencies (33)
+ 25 more
Changelog
Compare changes
|
|
2.4.8
patch
|
2.4.8
patch
Dependencies (33)
+ 25 more
Changelog
Compare changes
|
|
2.4.7
patch
|
2.4.7
patch
Dependencies (33)
+ 25 more
Changelog
Compare changes
|
|
2.4.6
patch
1 CVE
CVE-2025-34075
GHSA-hqp6-mjw3-f586
Jul 02, 2025
HashiCorp Vagrant has code injection vulnerability through default synced folders
Medium
Local
Low
Low
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. Affected versions
2.4.4
2.4.5
2.4.6
Fixed in
2.4.7
References
Updated Jul 05, 2025 · Source: OSV.dev |
2.4.6
patch
Dependencies (33)
+ 25 more
Changelog
Compare changes
|
|
2.4.5
patch
1 CVE
CVE-2025-34075
GHSA-hqp6-mjw3-f586
Jul 02, 2025
HashiCorp Vagrant has code injection vulnerability through default synced folders
Medium
Local
Low
Low
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. Affected versions
2.4.4
2.4.5
2.4.6
Fixed in
2.4.7
References
Updated Jul 05, 2025 · Source: OSV.dev |
2.4.5
patch
Dependencies (33)
+ 25 more
Changelog
Compare changes
|
|
2.4.4
major
1 CVE
CVE-2025-34075
GHSA-hqp6-mjw3-f586
Jul 02, 2025
HashiCorp Vagrant has code injection vulnerability through default synced folders
Medium
Local
Low
Low
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. Affected versions
2.4.4
2.4.5
2.4.6
Fixed in
2.4.7
References
Updated Jul 05, 2025 · Source: OSV.dev |
2.4.4
major
Dependencies (36)
+ 28 more
Changelog
Compare changes
|
|
1.5.0
minor
| ||
1.0.7
patch
|
1.0.7
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.6
patch
|
1.0.6
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.5
patch
|
1.0.5
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.4
patch
|
1.0.4
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.3
patch
|
1.0.3
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.2
patch
|
1.0.2
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.1
patch
|
1.0.1
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
1.0.0
major
|
1.0.0
major
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.7
patch
|
0.9.7
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.5
patch
|
0.9.5
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.4
patch
|
0.9.4
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.3
patch
|
0.9.3
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.2
patch
|
0.9.2
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.1
patch
|
0.9.1
patch
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.9.0
minor
|
0.9.0
minor
Dependencies (15)
+ 7 more
Changelog
Compare changes
|
|
0.8.10
patch
|
0.8.10
patch
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
0.8.8
patch
|
0.8.8
patch
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
0.8.7
patch
| ||
0.8.6
patch
| ||
0.8.5
patch
| ||
0.8.2
patch
| ||
0.8.1
minor
| ||
0.7.8
patch
| ||
0.7.7
patch
| ||
0.7.6
patch
| ||
0.7.5
patch
| ||
0.7.4
patch
| ||
0.7.3
patch
| ||
0.7.2
patch
| ||
0.7.1
patch
| ||
0.7.0
minor
| ||
0.7.0.beta2
pre
| ||
0.7.0.beta
pre
| ||
0.6.9
patch
| ||
0.6.8
patch
| ||
0.6.7
patch
| ||
0.6.6
patch
| ||
0.6.5
patch
| ||
0.6.4
patch
| ||
0.6.0
minor
| ||
0.6.3
patch
| ||
0.6.1
patch
| ||
0.6.2
patch
|