CVE-2022-1537: 
JavaScript vulnerability analysis and mitigation

CVE-2022-1537 is a vulnerability discovered in GruntJS prior to version 1.5.3, disclosed on May 10, 2022. The vulnerability affects file.copy operations in GruntJS, which are susceptible to a TOCTOU (Time-of-Check vs. Time-of-Use) race condition that could lead to arbitrary file writes (NVD, Ubuntu).

The vulnerability exists in the file.copy operations functionality of GruntJS. It manifests as a TOCTOU race condition that enables arbitrary file writes. The issue has been assigned a CVSS v3.1 base score of 7.0 (High), with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Ubuntu).

The vulnerability can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories. An attacker could potentially create a symlink to the GruntJS user's .bashrc file or replace sensitive system files like /etc/shadow if the GruntJS user has root privileges (Ubuntu).

The vulnerability has been fixed in GruntJS version 1.5.3. The fix was implemented through a patch that addresses the race condition in symlink copying, as documented in the commit 58016ff (GitHub Commit). Users are advised to upgrade to version 1.5.3 or later to mitigate this vulnerability.