CVE-2020-7729

Arbitrary Code Execution

High · published September 3, 2020

CVSS v3.1
7.1
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O
CVSS v4.0
Not supplied
EPSS
0.02304 · 83.2th percentile
Published
2020-09-03T09:00Z
EPSS history
Timeline
  • 03 SEP 09:00Z
    Arbitrary Code Execution
    cvelistv5