GitHub Advisoryadvisory · npm

GHSA-m5pj-vjjf-4m3h Arbitrary Code Execution in grunt

HIGH Published 2021-05-06 Modified 2021-05-04 Official page ↗
Aliases
CVE-2020-7729
Ecosystem
npm
Packages
grunt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1188
Reviewed
2021-05-04

Affected packages

• npm grunt: < 1.3.0 → fixed in 1.3.0

Description

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Related

Alias · CVE (1)

  • CVE-2020-7729 The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References