CVE-2026-17495
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.36%
- CWE
- CWE-27
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- moment moment
- moment moment
Weakness type
Related vulnerabilities
- CVE-2023-50254 — Deepin Reader RCE vulnerability due to a design flaw
- CVE-2023-52076 — Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
- CVE-2024-51747 — Arbitrary File Read and Delete in kanboard
- CVE-2025-66518 — Apache Kyuubi: Unauthorized directory access due to missing path normalization
- CVE-2025-58761 — Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
- CVE-2024-24809 — Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
- CVE-2026-24457 — An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server.
- CVE-2022-24785 — Path Traversal in Moment.js