CVE-2022-0436: Path Traversal in Grunt
Summary
CVE-2022-0436: Path Traversal in Grunt. Affects grunt versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Also tracked for
- grunt · Debian:11
The same CVE-2022-0436 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grunt is an open-source JavaScript task runner that automates repetitive tasks in web development. It is commonly used for building, testing, and deploying web applications. Grunt prior to version 1.5.2 is vulnerable to a path traversal vulnerability, which allows an attacker to access files outside of the intended directory.
Vulnerability Detail
The path traversal vulnerability in Grunt arises from insufficient input validation. An attacker can manipulate file paths to access sensitive files on the server. This could lead to unauthorized disclosure of sensitive information, remote code execution, or other malicious activities. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 1.6.3 as of 23 Oct 2026
npm install grunt@1.6.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
npm install grunt@1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The path traversal vulnerability in Grunt can have serious security implications. It is crucial to upgrade to the latest version of Grunt (1.5.2 or later) to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grunt →
FAQ
Grunt is a JavaScript task runner used for automating web development tasks.
A path traversal vulnerability allows an attacker to access files outside of the intended directory by manipulating file paths.
The path traversal vulnerability in Grunt can lead to unauthorized access to sensitive files, disclosure of confidential information, and remote code execution.
The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
To fix the vulnerability, upgrade Grunt to version 1.5.2 or later by running the command 'npm install grunt@1.5.2'.
References
Related vulnerabilities
Recent vulnerabilities recorded for grunt.
