CVE-2022-1537
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
CVE-2022-1537- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2022-5193
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
EUVD-2022-5193- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rm36-94g8-835r
Race Condition in Grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
GHSA-rm36-94g8-835r- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
NVD
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
CVE-2022-1537- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-367
- Updated
- 2026-11-02
OSVAZL-44082
CVE-2022-1537 affecting package js-jquery 3.5.0-4
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
AZL-44082- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSV
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
CVE-2022-1537- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2022-1537
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
DEBIAN-CVE-2022-1537- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-rm36-94g8-835r
Race Condition in Grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
GHSA-rm36-94g8-835r- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-1537
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
- Record
UBUNTU-CVE-2022-1537- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-5847-1 No score
grunt vulnerabilities
It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-7729)
It was discovered that Grunt was not properly handling symbolic links when performing file copy operations. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. (CVE-2022-0436)
It was discovered that there was a race condition in the Grunt file copy function, which could lead to an arbitrary file write. An attacker could possibly use this issue to perform a local privilege escalation attack or to execute arbitrary code. (CVE-2022-1537)
- Record
USN-5847-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gruntnpm |
before 1.5.3 | 1.5.3 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
gruntDebian:12 |
before 1.5.3-1 | 1.5.3-1 |
gruntDebian:13 |
before 1.5.3-1 | 1.5.3-1 |
gruntDebian:14 |
before 1.5.3-1 | 1.5.3-1 |
gruntDebian:10 |
before 1.0.1-8+deb10u2, plus listed versions 1.0.1-81.0.1-8+deb10u1 |
1.0.1-8+deb10u2 |
gruntUbuntu:Pro:18.04:LTS |
before 1.0.1-8ubuntu0.1+esm1, plus listed versions 1.0.1-51.0.1-61.0.1-71.0.1-81.0.1-8ubuntu0.1 |
1.0.1-8ubuntu0.1+esm1 |
gruntUbuntu:Pro:20.04:LTS |
before 1.0.4-2ubuntu0.1~esm1, plus listed versions 1.0.1-91.0.4-2 |
1.0.4-2ubuntu0.1~esm1 |
gruntUbuntu:Pro:22.04:LTS |
before 1.4.1-2ubuntu0.1~esm1, plus listed versions 1.3.0-11.3.0-21.4.1-11.4.1-2 |
1.4.1-2ubuntu0.1~esm1 |
gruntUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 1.0.1-8ubuntu0.1+esm1, plus listed versions 1.0.1-51.0.1-61.0.1-71.0.1-81.0.1-8ubuntu0.1 |
1.0.1-8ubuntu0.1+esm1 |
gruntUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 1.0.4-2ubuntu0.1~esm1, plus listed versions 1.0.1-91.0.4-2 |
1.0.4-2ubuntu0.1~esm1 |
gruntUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.4.1-2ubuntu0.1~esm1, plus listed versions 1.3.0-11.3.0-21.4.1-11.4.1-2 |
1.4.1-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1537 is a high vulnerability (CVSS 7.8) in Gruntjs Grunt, published May 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in grunt 1.5.3.
References
huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d
github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae
lists.debian.org/debian-lts-announce/2023/04/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2022-1537