CVE-2020-7729

PoC —

CVSS 3.1

7.1 high

EPSS

2%p82

Published

Sep 3, 2020 (Sep 3, 2020)

Modified

Jun 17, 2026

Description

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Vendors: gruntjs debian canonical
Products: grunt, debian linux, ubuntu linux
Weakness: CWE-1188
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.3%)

In the news0 stories

No ingested article mentions this CVE yet.