[Pkg-javascript-devel] Bug#969668: grunt: CVE-2020-7729

[Salvatore Bonaccorso]

Source: grunt
Version: 1.0.4-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 1.0.1-8

Hi,

The following vulnerability was published for grunt.

CVE-2020-7729[0]:
| The package grunt before 1.3.0 are vulnerable to Arbitrary Code
| Execution due to the default usage of the function load() instead of
| its secure replacement safeLoad() of the package js-yaml inside
| grunt.file.readYAML.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-7729
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7729
[1] https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7
[2] https://snyk.io/vuln/SNYK-JS-GRUNT-597546

Regards,
Salvatore