CVE-2022-25962

9.8 criticalEPSS 1.0%

Critical (9.8) in vagrant.js project vagrant.js. EPSS 1.0% chance of exploitation in the next 30 days.

All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2023-01-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-54jw-jqr9-6cj9	npm	vagrant.js	<=0.0.4	no fix published