What’s Vulnerable › Vulnerabilities

CVE-2022-24785: Path Traversal in Moment.js

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-04 · updated 2026-06-17
• Weakness: CWE-22

Description

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 35, 36
• Momentjs Moment: from 1.0.1 before 2.29.2 — fixed in 2.29.2
• NetApp Active Iq: all versions
• Tenable.sc: before 5.21.0 — fixed in 5.21.0
• Npm Moment: before 2.29.2 — fixed in 2.29.2
• Nuget Moment.Js: before 2.29.2; 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.6.0 (+66) — fixed in 2.29.2

How to fix

Upgrade to a fixed version: Momentjs Moment 2.29.2; Tenable.sc 5.21.0; Npm Moment 2.29.2; Nuget Moment.Js 2.29.2. Check the vendor advisory for mitigations.

References

• https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
• https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
• https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
• https://security.netapp.com/advisory/ntap-20220513-0006/
• https://www.tenable.com/security/tns-2022-09
• https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
• https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
• https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/

Get alerted when CVE-2022-24785 or the next vulnerability affects your stack