CVE-2020-7729

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77309.8The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.CVE-2020-77317.5This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending CVE-2020-77337.5The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi CVE-2020-77348.2All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.CVE-2020-77356.6The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.CVE-2020-77369.8The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.CVE-2020-77379.8All versions of package safetydance are vulnerable to Prototype Pollution via the set function.CVE-2020-77388.3All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-y CVE-2020-77398.2This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instanc CVE-2020-77408.2This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to CVE-2020-77419.9This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any ch CVE-2020-77427.5This affects the package simpl-schema before 1.10.2.