This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-7729 →

DEBIAN-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replac...

Original description

The description as published by the source.

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 grunt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]

Debian:13 grunt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]

Debian:14 grunt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]

References

advisory security-tracker.debian.org