Grunt

grunt

Vendor: Gruntjs • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-1537 1Gruntjs 1Grunt Jun 17, 2026 May 10, 2022 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which ca...Show more file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.Show less
CVE-2022-0436 1Gruntjs 1Grunt Jun 17, 2026 Apr 12, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
CVE-2020-7729 3Canonical DebianGruntjs 3Debian Linux GruntUbuntu Linux Jun 17, 2026 Sep 3, 2020 N/A· v4 7.1 HIGH· v3 4.6 MEDIUM· v2 The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.