CVE-2022-24785: Path Traversal Vulnerability in moment.js
Summary
CVE-2022-24785: Path Traversal: 'dir/../../filename' in moment.locale. Affects moment versions < 2.29.2. Fixed in 2.29.2. How to fix ↓
Also tracked for
- node-moment · Debian:11
The same CVE-2022-24785 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moment.js is a popular JavaScript library for parsing, validating, manipulating, and formatting dates and times. It is widely used in web development projects to handle date and time-related operations. However, a path traversal vulnerability has been discovered in the moment.locale function, which can be exploited by malicious users to access files outside of the intended directory.
Vulnerability Detail
The path traversal vulnerability in moment.js occurs when a user-provided locale string, such as 'dir/../../filename', is directly used to switch the moment locale. This allows an attacker to navigate to parent directories and access sensitive files on the server. The impact of this vulnerability is significant, especially for npm (server) users of moment.js. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2.31.0 as of 22 Oct 2026
npm install moment@2.31.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.29.2
This is the first release that contains the fix.
npm install moment@2.29.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to sanitize the user-provided locale name before passing it to moment.js. This can be done by validating and restricting the input to prevent any path traversal characters or sequences. Here's an example of how to sanitize the locale name in JavaScript:
function sanitizeLocale(locale) {
return locale.replace(/[./\]/g, '');
}
Conclusion
The path traversal vulnerability in moment.js can have serious consequences for applications that utilize the library. It is crucial to update to the latest version of moment.js (2.29.2) or apply the recommended workaround to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moment →
FAQ
Moment.js is a JavaScript library used for parsing, validating, manipulating, and formatting dates and times in web development projects.
A path traversal vulnerability, also known as directory traversal or directory climbing, allows an attacker to access files or directories outside of the intended scope by manipulating input that specifies a file or directory path.
The path traversal vulnerability in moment.js can be exploited by malicious users to access sensitive files on the server, potentially leading to unauthorized disclosure of information or remote code execution.
Yes, the moment.js project has released a patch to address this vulnerability in version 2.29.2. It is recommended to update to the latest version to mitigate the risk.
Yes, a temporary workaround is to sanitize the user-provided locale name before passing it to moment.js. By validating and restricting the input, the risk of path traversal can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for moment.
