Local privilege escalation via destination symlink race

A TOCTOU race in Grunt before 1.5.3 allows local users to write arbitrary files through file.copy operations on attacker-controlled paths. The file.copy path checked and unlinked a destination symlink before file._copy wrote to the same path, allowing the link to be replaced between check and use. Exploitation requires a lower-privileged user to write both source and destination directories and can modify files owned by Grunt's account, including shell startup files.