CVE-2020-7729 | BDVDB-2026-141015 Detail
grunt
Description#
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html
- https://usn.ubuntu.com/4595-1/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.