Vulnerability Description
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gruntjs | Grunt | < 1.3.0 |
| Debian | Debian Linux | 9.0 |
| Canonical | Ubuntu Linux | 18.04 |
Related Weaknesses (CWE)
References
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249Broken Link
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546ExploitThird Party Advisory
- https://usn.ubuntu.com/4595-1/Third Party Advisory
- https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249Broken Link
- https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/09/msg00008.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-GRUNT-597546ExploitThird Party Advisory
- https://usn.ubuntu.com/4595-1/Third Party Advisory
FAQ
What is CVE-2020-7729?
CVE-2020-7729 is a vulnerability with a CVSS score of 7.1 (HIGH). The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside gru...
How severe is CVE-2020-7729?
CVE-2020-7729 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7729?
Check the references section above for vendor advisories and patch information. Affected products include: Gruntjs Grunt, Debian Debian Linux, Canonical Ubuntu Linux.