GitHub Advisoryadvisory · npm, NuGet

GHSA-8hfj-j24r-96c4 Path Traversal: 'dir/../../filename' in moment.locale

HIGH Published 2022-04-04 Modified 2025-11-04 Official page ↗
Aliases
CVE-2022-24785
Ecosystem
npm, NuGet
Packages
moment, Moment.js
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-27
Reviewed
2022-04-04

Affected packages

• npm moment: < 2.29.2 → fixed in 2.29.2 • NuGet Moment.js: < 2.29.2 → fixed in 2.29.2

Description

Impact This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale. Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive). Workarounds Sanitize user-provided locale name before passing it to moment.js. References _Are there any links users can visit to find out more?_ For more information If you have any questions or comments about this advisory: • Open an issue in moment repo

Related

Alias · CVE (1)

  • CVE-2022-24785 Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-27 Path Traversal: 'dir/../../filename' weakness

References