{"id":"CVE-2022-1537","aliases":["AZL-44082","DEBIAN-CVE-2022-1537","DLA-3383-1","EUVD-2022-5193","GHSA-rm36-94g8-835r","UBUNTU-CVE-2022-1537","USN-5847-1"],"status":"published","title":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00302,"percentile":0.23083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2022-05-10T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"grunt","fixed_in":["1.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"grunt","fixed_in":["1.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"grunt","fixed_in":["1.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"grunt","fixed_in":["1.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"grunt","fixed_in":["1.0.1-8+deb10u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"grunt","fixed_in":["1.0.1-8ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","fixed_in":["1.0.4-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"grunt","fixed_in":["1.4.1-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8+deb10u2"}]}],"versions":["1.0.1-8","1.0.1-8+deb10u1"]},{"source":"osv","ecosystem":"npm","package":"grunt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8ubuntu0.1+esm1"}]}],"versions":["1.0.1-5","1.0.1-6","1.0.1-7","1.0.1-8","1.0.1-8ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-2ubuntu0.1~esm1"}]}],"versions":["1.0.1-9","1.0.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2ubuntu0.1~esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.4.1-1","1.4.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-8ubuntu0.1+esm1"}]}],"versions":["1.0.1-5","1.0.1-6","1.0.1-7","1.0.1-8","1.0.1-8ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-2ubuntu0.1~esm1"}]}],"versions":["1.0.1-9","1.0.4-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"grunt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2ubuntu0.1~esm1"}]}],"versions":["1.3.0-1","1.3.0-2","1.4.1-1","1.4.1-2"],"bundled":3}],"products":[{"vendor":"gruntjs","product":"grunt"},{"vendor":"gruntjs","product":"gruntjs/grunt"}],"references":[{"url":"https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d","tags":["x_transferred","Exploit","Issue Tracking","Patch","Technical Description","web","report"]},{"url":"https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae","tags":["x_transferred","Patch","Technical Description","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00006.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1537","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rm36-94g8-835r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1537.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1537","tags":["advisory"]},{"url":"https://github.com/gruntjs/grunt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-1537","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5847-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-7729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0436","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-1537","title":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T00:00:00Z","modified":"2024-08-03T00:10:03.294Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-5193","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T00:00:00Z","modified":"2024-08-03T00:10:03Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:26:00.556048Z"}],"ghsa":[{"id":"GHSA-rm36-94g8-835r","title":"Race Condition in Grunt","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-11T00:01:37Z","modified":"2023-04-06T22:55:43Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"nvd":[{"id":"CVE-2022-1537","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T14:15:08.403Z","modified":"2026-06-17T04:22:38.09Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"AZL-44082","title":"CVE-2022-1537 affecting package js-jquery 3.5.0-4","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T14:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2022-1537","title":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T00:00:00Z","modified":"2026-10-28T02:30:40.931644558Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"DEBIAN-CVE-2022-1537","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T14:15:08.403Z","modified":"2026-11-03T08:00:30.158265341Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-rm36-94g8-835r","title":"Race Condition in Grunt","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-11T00:01:37Z","modified":"2026-09-10T03:49:40.619385608Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"UBUNTU-CVE-2022-1537","description":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","status":"published","published":"2022-05-10T14:15:00Z","modified":"2026-02-04T03:06:55.736712Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"DLA-3383-1","title":"grunt - security update","status":"published","published":"2023-04-05T00:00:00Z","modified":"2026-03-09T01:23:35.323833Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-5847-1","title":"grunt vulnerabilities","description":"It was discovered that Grunt was not properly loading YAML files before\nparsing them. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2020-7729)\n\nIt was discovered that Grunt was not properly handling symbolic links\nwhen performing file copy operations. An attacker could possibly use this\nissue to expose sensitive information or execute arbitrary code.\n(CVE-2022-0436)\n\nIt was discovered that there was a race condition in the Grunt file copy\nfunction, which could lead to an arbitrary file write. An attacker could\npossibly use this issue to perform a local privilege escalation attack or\nto execute arbitrary code. (CVE-2022-1537)\n","status":"published","published":"2023-02-07T18:56:35Z","modified":"2026-04-27T16:47:19.671911767Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}