VDB
KO
HIGH 7.5

GHSA-8hfj-j24r-96c4

Path Traversal: 'dir/../../filename' in moment.locale

Details

### Impact This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.

### Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).

### Workarounds Sanitize user-provided locale name before passing it to moment.js.

### References _Are there any links users can visit to find out more?_

### For more information If you have any questions or comments about this advisory: * Open an issue in [moment repo](https://github.com/moment/moment)

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / moment
Introduced in: 0 Fixed in: 2.29.2
Fix npm install moment@2.29.2
NuGet / Moment.js
Introduced in: 0 Fixed in: 2.29.2
Fix dotnet add package Moment.js --version 2.29.2

References