CVEvulnerability
CVE-2020-7729
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-09-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:N/AC:H/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-1188
Description
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Affected configurations
• gruntjs grunt (< 1.3.0)
• debian debian linux 9.0
• canonical ubuntu linux 18.04
Related
Weakness · CWE (1)
- CWE-1188 Initialization of a Resource with an Insecure Default weakness
References
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249 Broken Link
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html Mailing List, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546 Exploit, Third Party Advisory
- https://usn.ubuntu.com/4595-1/ Third Party Advisory
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249 Broken Link
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html Mailing List, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546 Exploit, Third Party Advisory
- https://usn.ubuntu.com/4595-1/ Third Party Advisory