CVE-2020-7729

Katalog CVE

CVSS 7.1 · High EPSS 2,3%

Kerentanan Initialization of a Resource with an Insecure Default pada gruntjs grunt, debian linux +1 lainnya. Skor CVSS 3.1 7.1 (High) menurut snyk.io.

Deskripsi (NVD)

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Rincian

Terbit di NVD

3 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html mailing list · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-GRUNT-597546 exploit · advisory pihak ketiga
• https://usn.ubuntu.com/4595-1/ advisory pihak ketiga
• https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249 broken link