CVE catalog

CVE-2022-1537

grunt: CVE-2022-1537

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangruntsid1.6.3-1fixed
Debiangruntforky1.6.3-1fixed
Debiangrunttrixie1.6.1-1fixed
Debiangruntbookworm1.5.3-2fixed
Ubuntugruntpro1.3.0-1vulnerable
Ubuntugruntpro1.3.0-2vulnerable
Ubuntugruntpro1.4.1-1vulnerable
Ubuntugruntpro1.4.1-2vulnerable
Ubuntugruntpro1.4.1-2ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangruntsourcesid1.5.3-1not yet assignedNot reportedNot reported
Debiangruntsourceforky1.5.3-1not yet assignedNot reportedNot reported
Debiangruntsourcetrixie1.5.3-1not yet assignedNot reportedNot reported
Debiangruntsourcebookworm1.5.3-1not yet assignedNot reportedNot reported
Ubuntugruntdebpro1.4.1-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2022-1537Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [grunt]Fixed
    Details (2)

    • 1.5.3-2 · all · bookworm

      Fixed · Fixed: 1.5.3-1

      dsa · grunt · debian · bookworm

    • 1.5.3-2 · all · bookworm

      Fixed · Fixed: 1.5.3-1

      dsa · grunt · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]