CVE-2020-7729: Canonical Ubuntu Linux

High severity, CVSS 7.1. EPSS: 2.3% chance of exploitation in the next 30 days.

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 9.0 only
• Gruntjs Grunt: before 1.3.0 (fixed in 1.3.0)

Published 2020-09-03. Last modified 2026-06-17.