CVE-2025-34075: HashiCorp Vagrant Code Injection Vulnerability via Default Synced Folders
Summary
CVE-2025-34075: HashiCorp Vagrant has code injection vulnerability through default synced folders. Affects vagrant versions >= 2.2.10, < 2.4.7. Fixed in 2.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vagrant is an open-source tool that enables users to build and manage virtualized development environments. It simplifies the process of creating reproducible environments by allowing developers to define their infrastructure as code. Vagrant supports various providers and configurations, making it a popular choice among developers. However, it has a vulnerability that arises from its default synced folder configuration, which can lead to security risks if not properly managed.
Vulnerability Detail
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. Vagrant automatically mounts the host system's project directory into the guest VM, including the Vagrantfile, which is a Ruby script evaluated by the host. If a low-privileged attacker gains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host runs any vagrant command, the injected code executes on the host with that user's privileges, leading to potential unauthorized access and control over the host system.
How To Fix
Latest published version: 2.4.9 as of 23 Oct 2026
gem install vagrant -v 2.4.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.7
This is the first release that contains the fix.
gem install vagrant -v 2.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the default synced folder configuration or restrict access to the Vagrantfile by ensuring that it is not writable by the guest VM. This can be done by modifying the permissions of the project directory on the host system.
Conclusion
The CVE-2025-34075 vulnerability in HashiCorp Vagrant presents a significant risk due to its potential for code injection from guest VMs to host systems. Users are strongly advised to update to version 2.4.7 or later to mitigate this risk. Additionally, utilizing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for vagrant →
FAQ
CVE-2025-34075 is a code injection vulnerability in HashiCorp Vagrant that allows attackers to execute arbitrary Ruby code on the host system from a guest VM.
Vagrant versions 2.4.6 and below are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider using a workaround by restricting access to the Vagrantfile or avoiding the default synced folder configuration.
The vulnerability can lead to unauthorized code execution on the host system, potentially compromising sensitive data and system integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vagrant.
