{"id":"CVE-2020-7729","published":"2020-09-03T09:00:15Z","modified":"2024-09-17T01:45:50Z","title":"Arbitrary Code Execution","vendor":null,"product":null,"tier":"tail","description":{"text":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02304,"percentile":0.83284,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-GRUNT-597546","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922","tags":["x_refsource_MISC"]},{"url":"https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249","tags":["x_refsource_MISC"]},{"url":"https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://usn.ubuntu.com/4595-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":21.6,"factors":[{"name":"EPSS percentile","points":16.66},{"name":"CVSS severity","points":4.97}]},"affectedVersions":[{"vendor":"n/a","product":"grunt","versions":[">= unspecified, < 1.3.0"]}],"affected":[{"ecosystem":"npm","package":"grunt","vulnerableRanges":["<1.3.0"],"patched":["1.3.0"],"from":["GHSA-m5pj-vjjf-4m3h"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1133","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-gruntjs-grunt-cve-2020-7729","children":[{"from":"CVE-2020-7729","to":"CVE-2022-0436","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:grunt","fromFixed":"1.3.0","toFixed":"1.5.2","daysApart":586},{"kind":"same-code","provenance":"machine","files":["lib/grunt/file.js"],"commits":["https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7","https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665","https://github.com/gruntjs/grunt/commit/b0ec6e12426fc8d5720dee1702f6a67455c5986c"],"basis":"rarely changed file"}]},{"from":"CVE-2020-7729","to":"CVE-2022-1537","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/grunt/file.js"],"commits":["https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7","https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-7729","published":"2020-09-03","fixed":"1.3.0","kev":false},{"cve":"CVE-2022-0436","published":"2022-04-12","fixed":"1.5.2","kev":false},{"cve":"CVE-2022-1537","published":"2022-05-10","fixed":"1.5.3","kev":false}],"package":"npm:grunt"}}