{"id":"GHSA-m5pj-vjjf-4m3h","summary":"Arbitrary Code Execution in grunt","details":"The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.","aliases":["CVE-2020-7729"],"modified":"2026-07-17T21:05:29.925252445Z","published":"2021-05-06T18:27:18Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-05-04T22:57:23Z","nvd_published_at":"2020-09-03T09:15:00Z","cwe_ids":["CWE-1188"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7729"},{"type":"WEB","url":"https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7"},{"type":"WEB","url":"https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-GRUNT-597546"},{"type":"WEB","url":"https://usn.ubuntu.com/4595-1"}],"affected":[{"package":{"name":"grunt","ecosystem":"npm","purl":"pkg:npm/grunt"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-m5pj-vjjf-4m3h/GHSA-m5pj-vjjf-4m3h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}