Description

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-15T06:16:57.597Z",
  "pubdate": "2026-09-15T06:16:57.597Z",
  "executiveSummary": "This vulnerability involves a path traversal flaw in the moment.locale() function of the Moment.js library, designated as an incomplete fix for CVE-2022-24785.\nThe issue affects versions 2.29.2 through 2.30.1 and primarily impacts server-side environments (Node.js/npm) where the application processes user-supplied input as locale identifiers.\nBy bypassing internal security guards, an attacker can trigger arbitrary file reads or code execution by manipulating the path segments processed by the internal require() call.\nThe vulnerability arises due to improper type validation, as the library assumes the input provided to moment.locale() is a primitive string.\nAn attacker can exploit this by passing a non-string object that satisfies the initial regex-based guard via a custom match() method, while providing a malicious path via the toString() method.\nSuccessful exploitation allows attackers to perform unauthorized path traversal on the underlying server filesystem.\nUsers are strongly advised to upgrade to version 2.31.0 or implement strict input validation to mitigate the risk of exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation within the moment.locale() function, which fails to account for objects that mimic string behavior to bypass security checks. Specifically, the library implements a regex-based guard designed to prevent path traversal; however, this guard assumes that the input passed to the function will be a primitive string.\nIn the affected versions (2.29.2 through 2.30.1), an attacker can provide a crafted object instead of a string. This object can be designed to implement a match() method that returns a truthy value to satisfy the library's initial security check. Simultaneously, the object's toString() method is configured to return a directory traversal string (e.g., '../../path/to/malicious/file').\nBecause the logic relies on the object's string-like characteristics but fails to verify the base type, the manipulated input proceeds to the internal require() call. The JavaScript runtime then converts this object into a string representation, effectively passing the traversal path directly into the filesystem module's resolution logic.\nThe attack flow proceeds as follows: 1) The application accepts user input and passes it directly to moment.locale(). 2) The attacker submits a malicious object containing a fabricated match() method and a malicious toString() return value. 3) The internal guard validates the match() return value and permits the operation. 4) The library triggers an internal require() statement, which resolves the relative path provided by the toString() method, allowing for the inclusion or reading of files outside the intended scope of the locale directory.\nThis vulnerability is particularly dangerous in Node.js server-side contexts where the application process possesses elevated permissions to interact with the server's filesystem. The impact of successful exploitation includes the potential for arbitrary file inclusion, which can lead to remote code execution (RCE) or sensitive information disclosure depending on the files accessible to the application process. The vulnerability is considered an incomplete patch, indicating that previous attempts to mitigate CVE-2022-24785 did not fully account for type-coercion bypasses."
}