{"action":"Upgrade vagrant to 2.4.7 or later.","affected":[{"fixed":"2.4.7","introduced":"2.2.10"}],"component":"vagrant","cve_ids":["CVE-2025-34075"],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["2.4.7"],"ghsa_id":"GHSA-hqp6-mjw3-f586","id":"tcs_01M5KEKP4X7NK7YDX1F6WZJPED","modified_at":"2025-07-05T02:25:30.297787Z","published_at":"2025-07-02T21:32:00Z","references":["https://osv.dev/vulnerability/GHSA-hqp6-mjw3-f586","https://nvd.nist.gov/vuln/detail/CVE-2025-34075","https://github.com/hashicorp/vagrant/issues/13688","https://github.com/hashicorp/vagrant/commit/abe87b2fdc124ef426c016d44d2f6f4792f0cbe3","https://developer.hashicorp.com/vagrant","https://developer.hashicorp.com/vagrant/docs/synced-folders/basic_usage","https://developer.hashicorp.com/vagrant/docs/vagrantfile","https://github.com/advisories/GHSA-hqp6-mjw3-f586","https://github.com/hashicorp/vagrant","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/vagrant/CVE-2025-34075.yml","https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb","https://vulncheck.com/advisories/hashicorp-vagrant-synced-folder-vagrantfile-breakout"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hqp6-mjw3-f586","url":"https://osv.dev/vulnerability/GHSA-hqp6-mjw3-f586"}],"summary":"HashiCorp Vagrant has code injection vulnerability through default synced folders"}