CVE-2020-7729 — Initialization of a Resource with an Insecure Default in Grunt
Severity
7.1HIGHNVD
EPSS
2.4%
top 14.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 3
Latest updateFeb 7
Description
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9
Affected Packages5 packages
Also affects: Debian Linux 9.0, Ubuntu Linux 18.04
Patches
🔴Vulnerability Details
6📋Vendor Advisories
3💬Community
3Bugzilla▶
CVE-2020-7729 nodejs-grunt: use of the unsafe load function from js-yaml package can lead to ACE [fedora-all]↗2020-09-03
Bugzilla▶
CVE-2020-7729 nodejs-grunt: use of the unsafe load function from js-yaml package can lead to ACE [epel-all]↗2020-09-03
Bugzilla▶
CVE-2020-7729 nodejs-grunt: use of the unsafe load function from js-yaml package can lead to ACE↗2020-09-03