Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-17495— moment vulnerable to Path Traversal via crafted non-string locale name

Quick assessment

Affected
moment moment
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moment 是一个用于解析、验证、操作和格式化日期的 JavaScript 日期库。在 2.29.2 至 2.30.1 版本中，一个精心构造的非字符串对象传入 可以绕过地域名称路径遍历防护机制。该防护机制假设输入为字符串类型，因此，如果一个对象的 方法满足检查条件，而其 方法返回一个遍历路径，则最终会执行到一个由攻击者控制的路径片段的内部 调用。这是针对 CVE-2022-24785 的不完整修复，主要影响直接将用户提供的输入传递给 的 npm（服务端）用户。该问题已在 Moment 2.31.0 中修复，建议用

CVSS 5.9 · Medium EPSS 0.36% · P29

Affected Version Matrix 2

VendorProduct Version RangeStatus
moment moment 2.29.2< 2.31.0 affected
2.31.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17495

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
moment vulnerable to Path Traversal via crafted non-string locale name
Source: CVE Program / CVE List V5
Vulnerability Description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’dir/../../filename’
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
moment moment 2.29.2 ~ 2.31.0 -

II. Public POCs for CVE-2026-17495

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17495

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-17495 (1)

IV. Related Vulnerabilities

Same product: moment
Same vendor: moment
Same weakness: CWE-27

V. Comments for CVE-2026-17495

No comments yet

Leave a comment