VULNERABILITY INTELLIGENCE

CVE-2020-7729

CVSS score7.1 HIGH

EPSS probability2.30%

CISA KEVNot currently listed

Published2020-09-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Weakness classification

nvd@nist.gov: CWE-1188

Primary references

report@snyk.io — Broken Link
report@snyk.io — Patch, Third Party Advisory
report@snyk.io — Mailing List, Third Party Advisory
report@snyk.io — Third Party Advisory
report@snyk.io — Exploit, Third Party Advisory
report@snyk.io — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory