{"schema":"threatline.record/2","record":{"id":"CVE-2026-17495","aliases":["GHSA-4p3w-j4w9-5jqw"],"summary":"moment vulnerable to Path Traversal via crafted non-string locale name","details":"### Impact\n\nmoment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-string, attacker-influenced value to `moment.locale()`, a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for [CVE-2022-24785](https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4).\n\nThis affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.\n\n### Patches\n\nThis issue is patched in moment 2.31.0.\n\n### Workarounds\n\nValidate that any user-supplied input is a string before passing it to `moment.locale()`.","categories":["Libraries & packages"],"product":"moment","vendor":"moment","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","source_modified_at":"2026-09-29T23:46:04Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"moment"},"range":">= 2.29.2, < 2.31.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17495","source_modified_at":"2026-09-15T17:49:57.391Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"moment","vendor":"moment","versions":[{"versionType":"semver","status":"affected","version":"2.29.2","lessThan":"2.31.0"},{"versionType":"semver","status":"unaffected","version":"2.31.0"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4p3w-j4w9-5jqw","source_modified_at":"2026-09-30T00:00:03.858466235Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"moment","purl":"pkg:npm/moment"},"ranges":[{"events":[{"introduced":"2.29.2"},{"fixed":"2.31.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","source_modified_at":"2026-09-29T23:46:04Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"moment"},"version":"2.31.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17495","source_modified_at":"2026-09-15T17:49:57.391Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"moment","ecosystem":null},"version":"2.31.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4p3w-j4w9-5jqw","source_modified_at":"2026-09-30T00:00:03.858466235Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"moment","purl":"pkg:npm/moment"},"version":"2.31.0"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00357,"percentile":0.28217,"score_date":"2026-10-23"},"published_at":"2026-09-15T05:40:55.263Z","modified_at":"2026-09-30T00:00:03.858466235Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-29T23:46:04Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-17495","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-15T17:49:57.391Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4p3w-j4w9-5jqw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T00:00:03.858466235Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17495","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","source":"GitHub Advisory Database"},{"url":"https://github.com/moment/moment/pull/6386","source":"GitHub Advisory Database"},{"url":"https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/moment/moment/releases/tag/2.31.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-15T17:49:29.629363Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T00:00:03.858466235Z","content_hash":"b56887b661ee50e22fc6f5c125e2b7743585bd7f8a1e2926e47b7a77056daae6"}}