VDB
Sign up
HIGH7.5

GHSA-8hfj-j24r-96c4

Path Traversal: 'dir/../../filename' in moment.locale

Quick fix

GHSA-8hfj-j24r-96c4 — moment: upgrade to the fixed version with the command below.

npm install moment@2.29.2

Details

### Impact This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.

### Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).

### Workarounds Sanitize user-provided locale name before passing it to moment.js.

### References _Are there any links users can visit to find out more?_

### For more information If you have any questions or comments about this advisory: * Open an issue in [moment repo](https://github.com/moment/moment)

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/moment
Introduced in: 0Fixed in: 2.29.2
Fixnpm install moment@2.29.2
NuGet/Moment.js
Introduced in: 0Fixed in: 2.29.2
Fixdotnet add package Moment.js --version 2.29.2

References