CVE-2022-0436

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Grunt prior to version 1.5.2 is vulnerable to path traversal.

Grunt is the JavaScript task runner. Why use a task runner? In one word: automation. The less work you have to do when performing repetitive tasks like minification, compilation, unit testing, linting, etc, the easier your job becomes. After you've configured it, a task runner can do most of that mundane work for you with basically zero effort.

Security Fix(es): Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.(CVE-2022-0436)

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-7729)

It was discovered that Grunt was not properly handling symbolic links when performing file copy operations. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. (CVE-2022-0436)

It was discovered that there was a race condition in the Grunt file copy function, which could lead to an arbitrary file write. An attacker could possibly use this issue to perform a local privilege escalation attack or to execute arbitrary code. (CVE-2022-1537)