CVE-2022-1537

CVE-2022-1537 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability affecting file.copy operations in GruntJS versions prior to 1.5.3. This flaw allows for arbitrary file writes, potentially leading to local privilege escalation if a lower-privileged user can manipulate both source and destination directories. The vulnerability has a CVSS score of 7.0 (High), indicating a high impact on confidentiality, integrity, and availability, with a local attack vector and high attack complexity. Successful exploitation could allow an attacker to gain privileges of the GruntJS user, even replacing critical system files if the GruntJS user has root privileges. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.