All vulnerabilities
CVE-2026-17495GHSA-4p3w-j4w9-5jqw

moment vulnerable to Path Traversal via crafted non-string locale name

moment momentnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.31.0Fixed versionGitHub
Published15 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.

This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.

Patches

This issue is patched in moment 2.31.0.

Workarounds

Validate that any user-supplied input is a string before passing it to moment.locale().

Text from GitHub Advisory Database

Affected versions 4

  • moment, npm>= 2.29.2, < 2.31.0GitHub
  • momentaffected: 2.29.2 before 2.31.0CVE List
  • momentunaffected: 2.31.0CVE List
  • moment, npmfrom 2.29.2, fixed in 2.31.0OSV

References 7