{"id":"CVE-2020-7729","aliases":["AZL-44379","DEBIAN-CVE-2020-7729","DLA-2368-1","EUVD-2021-1133","GHSA-m5pj-vjjf-4m3h","OESA-2022-1544","OESA-2022-2048","UBUNTU-CVE-2020-7729","USN-4595-1","USN-5847-1"],"status":"published","title":"Arbitrary Code Execution","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02304,"percentile":0.83455,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188"],"published":"2020-09-03T09:00:15Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"grunt","fixed_in":["1.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"grunt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"grunt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"grunt","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"grunt","fixed_in":["1.0.1-5+deb9u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-grunt","fixed_in":["1.0.1-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-grunt","fixed_in":["1.0.1-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-grunt","fixed_in":["1.0.1-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-grunt","fixed_in":["1.0.1-5.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"grunt","fixed_in":["1.0.1-8ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","fixed_in":["1.0.4-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-5+deb9u1"}]}],"versions":["1.0.1-5"]},{"source":"osv","ecosystem":"npm","package":"grunt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-5.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8ubuntu0.1"}]}],"versions":["1.0.1-5","1.0.1-6","1.0.1-7","1.0.1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-2ubuntu0.1~esm1"}]}],"versions":["1.0.1-9","1.0.4-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8ubuntu0.1"}]}],"versions":["1.0.1-5","1.0.1-6","1.0.1-7","1.0.1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8ubuntu0.1+esm1"}]}],"versions":["1.0.1-5","1.0.1-6","1.0.1-7","1.0.1-8","1.0.1-8ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-2ubuntu0.1~esm1"}]}],"versions":["1.0.1-9","1.0.4-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2ubuntu0.1~esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.4.1-1","1.4.1-2"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gruntjs","product":"grunt"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-GRUNT-597546","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4595-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7729","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m5pj-vjjf-4m3h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7729","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4595-1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1544","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2048","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7729","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4595-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5847-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1537","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7729","title":"Arbitrary Code Execution","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:00:15.371Z","modified":"2024-09-17T01:45:50.965Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2021-1133","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:00:15Z","modified":"2024-09-17T01:45:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O","level":"high"}],"updated_at":"2026-11-03T00:28:47.09844Z"}],"ghsa":[{"id":"GHSA-m5pj-vjjf-4m3h","title":"Arbitrary Code Execution in grunt","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2021-05-06T18:27:18Z","modified":"2023-02-01T05:05:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:36:34.260786Z"}],"nvd":[{"id":"CVE-2020-7729","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:15:10.36Z","modified":"2026-06-17T03:25:20.46Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"AZL-44379","title":"CVE-2020-7729 affecting package js-jquery 3.5.0-4","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2020-7729","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:15:10.36Z","modified":"2026-10-20T10:54:24.512687459Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7729","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:15:10.36Z","modified":"2026-10-26T12:02:15.841460008Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-m5pj-vjjf-4m3h","title":"Arbitrary Code Execution in grunt","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2021-05-06T18:27:18Z","modified":"2026-09-10T03:49:05.039322697Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"OESA-2022-1544","title":"nodejs-grunt security update","description":"Grunt is the JavaScript task runner. Why use a task runner? In one word: automation. The less work you have to do when performing repetitive tasks like minification, compilation, unit testing, linting, etc, the easier your job becomes. After you\u0026apos;ve configured it, a task runner can do most of that mundane work for you with basically zero effort.\r\n\r\nSecurity Fix(es):\r\n\r\nThe package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.(CVE-2020-7729)","status":"published","published":"2022-03-07T11:04:49Z","modified":"2026-08-18T01:15:38.965381231Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2048","title":"nodejs-grunt security update","description":"Grunt is the JavaScript task runner. Why use a task runner? In one word: automation. The less work you have to do when performing repetitive tasks like minification, compilation, unit testing, linting, etc, the easier your job becomes. After you\u0026apos;ve configured it, a task runner can do most of that mundane work for you with basically zero effort.\r\n\r\nSecurity Fix(es):\r\n\r\nThe package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.(CVE-2020-7729)","status":"published","published":"2022-11-11T11:05:21Z","modified":"2026-08-18T01:17:21.357177664Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2020-7729","description":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","status":"published","published":"2020-09-03T09:15:00Z","modified":"2026-02-04T04:23:16.451241Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DLA-2368-1","title":"grunt - security update","status":"published","published":"2020-09-09T00:00:00Z","modified":"2026-03-09T01:20:44.416977Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-4595-1","title":"grunt vulnerability","description":"It was discovered that Grunt did not properly load yaml files. An attacker\ncould possibly use this to execute arbitrary code. (CVE-2020-7729)\n","status":"published","published":"2020-10-20T20:49:50Z","modified":"2026-02-10T04:41:58Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-5847-1","title":"grunt vulnerabilities","description":"It was discovered that Grunt was not properly loading YAML files before\nparsing them. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2020-7729)\n\nIt was discovered that Grunt was not properly handling symbolic links\nwhen performing file copy operations. An attacker could possibly use this\nissue to expose sensitive information or execute arbitrary code.\n(CVE-2022-0436)\n\nIt was discovered that there was a race condition in the Grunt file copy\nfunction, which could lead to an arbitrary file write. An attacker could\npossibly use this issue to perform a local privilege escalation attack or\nto execute arbitrary code. (CVE-2022-1537)\n","status":"published","published":"2023-02-07T18:56:35Z","modified":"2026-04-27T16:47:19.671911767Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}