debian/grunt vulnerabilities

Latest debian/grunt CVEs

Newest publication first

1. DLA-3386-1 grunt - security update

   Published 2023-04-06

   Unknown

2. DLA-3383-1 grunt - security update

   Published 2023-04-05

   Unknown

3. CVE-2022-1537 file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt

   Published 2022-05-10

   High·CVSS 7.0 EPSS 0.30%

   file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if...

4. CVE-2022-0436 Path Traversal in gruntjs/grunt

   Published 2022-04-12

   Medium·CVSS 5.5 EPSS 0.59%

   Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

5. DLA-2368-1 grunt - security update

   Published 2020-09-09

   Unknown

6. CVE-2020-7729 Arbitrary Code Execution

   Published 2020-09-03

   High·CVSS 7.1 EPSS 2.3%

   The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.