Medium severity - Race Condition vulnerability in grunt (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: grunt
• Introduced through: juice-shop@12.3.0 and grunt@1.4.1

Detailed paths

• Introduced through: juice-shop@12.3.0 › grunt@1.4.1

Overview

grunt is a JavaScript task runner.
Affected versions of this package are vulnerable to Race Condition via the file.copy operations. Exploiting this vulnerability leads to arbitrary file writing when an attacker can create a symlink just after deletion of the destination symlink, but right before the symlink is being written.

Remediation

Upgrade grunt to version 1.5.3 or higher.

References

• GitHub Commit
• GitHub PR
  
  SNYK-JS-GRUNT-2813632
  (CVE-2022-1537) grunt@1.4.1