CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2020-7729
High (7.1). EPSS 2.3% chance of exploitation in the next 30 days. Fixed in grunt 1.3.0.
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1188
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- gruntjs:grunt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m5pj-vjjf-4m3h | npm | grunt | <1.3.0 | 1.3.0 |
References
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546