HighFix available
grunt — security advisory
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
- Products
- grunt
- Affected versions
- Not specified
- Fixed versions
- 1.3.0-1
- CVEs
- CVE-2020-7729
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:16 UTC · Revision 1
Source evidence
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
osv:DEBIAN-CVE-2020-7729
grunt
Fixed versions: 1.3.0-1
grunt
Fixed versions: 1.3.0-1
grunt
Fixed versions: 1.3.0-1
Complete source record
{
"id": "51b65f38c135e0857489eff052c37a0c20f19bbe13692be34287456cd2c46c26",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-7729",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-7729",
"summary": "The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.",
"evidence": "osv:DEBIAN-CVE-2020-7729",
"products": [
{
"name": {
"value": "grunt",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "grunt",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "grunt",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2020-7729",
"aliases": [
"DEBIAN-CVE-2020-7729"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0-1"
}
]
}
],
"package": {
"name": "grunt",
"purl": "pkg:deb/debian/grunt?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7729.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0-1"
}
]
}
],
"package": {
"name": "grunt",
"purl": "pkg:deb/debian/grunt?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7729.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0-1"
}
]
}
],
"package": {
"name": "grunt",
"purl": "pkg:deb/debian/grunt?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-7729.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:15.841460008Z",
"provider": "osv",
"upstream": [
"CVE-2020-7729"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-7729"
]
},
"related_cves": [
{
"value": "CVE-2020-7729",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 452065,
"published_at": "2020-09-03T09:15:10.36+00:00"
}