468 matches found
retire.js
Retire.js Retire Status What you require you must also retire There are a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development, but we need to stay up-to-date on security fixes. "Using Components with Known Vulnerabilities" is now ...
Astra Linux – Vulnerability in Grunt
The file.copy operations in GruntJS are vulnerable to a TOCTOU race condition, which can lead to arbitrary file writes in the GitHub repository gruntjs/grunt before version 1.5.3. This vulnerability allows for arbitrary file writes that can lead to local privilege escalation to the GruntJS user...
Astra Linux – Vulnerability in Grunt
Path traversal in the GitHub repository gruntjs/grunt before version 1.5.2...
Malicious Package
Overview dagda-gulp-quito-grunt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093223)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093223 advisory. The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093610)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093610 advisory. Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. Tenable has extracted the preceding description block directly from the Unity Linux security...
CLSA-2026-1774398085 TuxCare security update for grunt-karma (1 CVE)
TuxCare rebuilt grunt-karma to address 1 CVE. Fixed in 4.0.1-tuxcare.1...
PT-2026-74119
TuxCare rebuilt grunt-karma to address 1 CVE. Fixed in 4.0.1-tuxcare.1...
RCE (Remote Code Execution) grunt Dependency in Bitbucket Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in version 10.3.0 of Bitbucket Data Center. This Remote Code Execution vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H allows an unauthenticated attacker to expose...
WS-2019-0432
Grunt-radical, version 0.0.14 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
Malicious Package
Overview ig-grunt-release is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview ig-grunt-file-list is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
grunt-willitmerge (>=0.2.0, <=1.0.0) potentially affected by CVE-2025-66219 via willitmerge (0.1.2)
willitmerge NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on willitmerge and may be impacted: - grunt-willitmerge =0.2.0, =1.0.0 Source cves: CVE-2025-66219 Source advisory: SNYK:JS-WILLITMERGE-14135971...
grunt-willitmerge (>=0.2.0, <=1.0.0) potentially affected by CVE-2025-66219 via willitmerge (0.1.2)
willitmerge NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on willitmerge and may be impacted: - grunt-willitmerge =0.2.0, =1.0.0 Source cves: CVE-2025-66219 Source advisory: OSV:GHSA-J9WJ-M24M-7JJ6...
Malicious code in grus-pipe-websockets-grunt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e908ab5a9f1588062bc9ccd9e3447dc656308f6a5f76ad9232116d8165cebad8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179517
Malicious code in cosmos-yonder-grunt-nashira npm...
EUVD-2025-180384
Malicious code in apollo-ini-grunt-radiant npm...
EUVD-2025-177050
Malicious code in private-dorado-grunt-jupiter npm...