Skip to content
OpenAdvisories
High USN-4595-1 1 CVE

grunt vulnerability

Published Oct 20, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Grunt did not properly load yaml files. An attacker
could possibly use this to execute arbitrary code. (CVE-2020-7729)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS grunt 1.0.1-8ubuntu0.1

Vulnerabilities 1

  • High 7.1
    CVE-2020-7729

    Arbitrary Code Execution

    The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

    js-jquery grunt grunt grunt Debian Ubuntu Azure Linux npm

References

  • report
    https://ubuntu.com/security/CVE-2020-7729