CVE-2022-1537: Race Condition in Grunt
Summary
CVE-2022-1537: Race Condition in Grunt. Affects grunt versions < 1.5.3. Fixed in 1.5.3. How to fix ↓
Also tracked for
- grunt · Debian:11
The same CVE-2022-1537 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grunt is a JavaScript task runner that automates repetitive tasks such as minification, compilation, and testing. It is widely used in web development projects to streamline the build process. However, versions of Grunt prior to 1.5.3 are vulnerable to a race condition that can lead to arbitrary file writes. This vulnerability can be exploited by a lower-privileged user with write access to both the source and destination directories. By creating a symlink to the GruntJS user's .bashrc file or replacing the /etc/shadow file, the attacker can escalate their privileges, potentially gaining root access.
Vulnerability Detail
The vulnerability in Grunt arises from a time-of-check to time-of-use (TOCTOU) race condition in the file.copy operations. This race condition allows an attacker to manipulate the file copying process and overwrite arbitrary files. By carefully timing their actions, the attacker can create a symlink to the GruntJS user's .bashrc file or replace critical system files like /etc/shadow. This can lead to privilege escalation and compromise the security of the system.
How To Fix
Latest published version: 1.6.3 as of 23 Oct 2026
npm install grunt@1.6.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.3
This is the first release that contains the fix.
npm install grunt@1.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Grunt is not immediately possible, a temporary workaround is to restrict write access to the source and destination directories for lower-privileged users. By limiting write permissions, the race condition can be mitigated. However, this is only a temporary solution, and updating to the latest version of Grunt is still recommended.
Conclusion
The race condition vulnerability in Grunt prior to version 1.5.3 can lead to arbitrary file writes and local privilege escalation. It is crucial to update Grunt to the latest version to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grunt →
FAQ
Grunt is a JavaScript task runner used for automating repetitive tasks in web development projects.
A race condition is a software vulnerability that occurs when the behavior of a program depends on the relative timing of events.
By carefully timing their actions, an attacker can manipulate the file copying process in Grunt and overwrite arbitrary files, potentially gaining unauthorized access.
The vulnerability can lead to local privilege escalation, allowing an attacker to gain higher privileges on the system and potentially compromise its security.
You can update Grunt to the fixed version (1.5.3) by running the command: npm install grunt@1.5.3
Related vulnerabilities
Recent vulnerabilities recorded for grunt.
