Executive brief
Grunt is a popular JavaScript task runner used to automate build and development workflows. Versions before 1.3.0 are vulnerable to arbitrary code execution when loading YAML configuration files due to use of an unsafe YAML parser. An attacker who can control or modify a Gruntfile or YAML configuration file could execute arbitrary code with the privileges of the user running Grunt, potentially compromising the development environment and any artifacts produced by the build process.
Technical details
The vulnerability exists in the grunt.file.readYAML() function, which uses the unsafe load() method from the js-yaml library instead of the secure safeLoad() alternative. This allows deserialization of arbitrary JavaScript objects from YAML files. The attack requires the ability to control the contents of a YAML configuration file that Grunt reads (typically in a Gruntfile or configuration files). Since Grunt is primarily used in development environments and CI/CD pipelines, exploitation could lead to code execution in these contexts. The vulnerability was patched in version 1.3.0 by switching to safeLoad(), with an optional unsafeLoad parameter available for users who require the previous behavior.
Affected products
- Grunt Grunt before 1.3.0
Timeline
- 2020-09-03: disclosed
- 2021-05-06: patched: Fix released in version 1.3.0