437 matches found
retire.js
Retire.js What you require you must also retire There are a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development, but we need to stay up-to-date on security fixes. "Using Components with Known Vulnerabilities" is now a part of the...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093610)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093610 advisory. Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. Tenable has extracted the preceding description block directly from the Unity Linux security...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093223)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093223 advisory. The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of...
CLSA-2026-1774398085 TuxCare security update for grunt-karma (8 CVEs)
TuxCare rebuilt grunt-karma to address 8 CVEs. Fixed in 4.0.1-tuxcare.1...
RCE (Remote Code Execution) grunt Dependency in Bitbucket Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in version 10.3.0 of Bitbucket Data Center. This Remote Code Execution vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H allows an unauthenticated attacker to expose...
Astra Linux – Vulnerability in Grunt
The file.copy operations in GruntJS are vulnerable to a TOCTOU race condition, which can lead to arbitrary file writes in the GitHub repository gruntjs/grunt before version 1.5.3. This vulnerability allows for arbitrary file writes that can lead to local privilege escalation to the GruntJS user...
Astra Linux – Vulnerability in Grunt
Path traversal in the GitHub repository gruntjs/grunt before version 1.5.2...
Malicious Package
Overview ig-grunt-file-list is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview ig-grunt-release is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
grunt-willitmerge (>=0.2.0, <=1.0.0) potentially affected by CVE-2025-66219 via willitmerge (0.1.2)
willitmerge NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on willitmerge and may be impacted: - grunt-willitmerge =0.2.0, =1.0.0 Source cves: CVE-2025-66219 Source advisory: SNYK:JS-WILLITMERGE-14135971...
grunt-willitmerge (>=0.2.0, <=1.0.0) potentially affected by CVE-2025-66219 via willitmerge (0.1.2)
willitmerge NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on willitmerge and may be impacted: - grunt-willitmerge =0.2.0, =1.0.0 Source cves: CVE-2025-66219 Source advisory: OSV:GHSA-J9WJ-M24M-7JJ6...
Malicious code in sagitta-shelljs-halley-grunt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27d14c78f0650cc9e36a6a09704b5376e65f49f575b3bcc650e67f28f0dbb37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178637
Malicious code in grus-pipe-websockets-grunt npm...
EUVD-2025-178437
Malicious code in impulse-holography-grunt-sequelize npm...
Malicious code in grus-pipe-websockets-grunt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e908ab5a9f1588062bc9ccd9e3447dc656308f6a5f76ad9232116d8165cebad8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178573
Malicious code in heka-relay-grunt-gammarayburst npm...
EUVD-2025-177050
Malicious code in private-dorado-grunt-jupiter npm...
EUVD-2025-176267
Malicious code in spectron-grunt-auth-europa npm...