Low severity3.8NVD Advisory· Published Oct 27, 2023· Updated Jun 17, 2026

CVE-2023-5834

Description

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/hashicorp/vagrantGo	< 2.4.0	2.4.0

Affected products

Hashicorp/Vagrant2 versions
cpe:2.3:a:hashicorp:vagrant:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hashicorp:vagrant:*:*:*:*:*:*:*:*range: <2.4.0
- (no CPE)range: *
ghsa-coords
pkg:golang/github.com/hashicorp/vagrant
Range: < 2.4.0

Patches

Vulnerability mechanics

References

discuss.hashicorp.com/t/hcsec-2023-31-vagrant-s-windows-installer-allowed-directory-junction-write/59568nvdVendor AdvisoryWEB
github.com/advisories/GHSA-47xw-vw6m-w9fqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-5834ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.247
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000