DEBIAN-CVE-2026-17495
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-17495
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-17495.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-17495
- Upstream
- Published
- 2026-09-15T06:16:57Z
- Modified
- 2026-09-17T08:47:24Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
- References
Affected packages
Debian:12 / node-moment
Package
- Name
- node-moment
- Purl
- pkg:deb/debian/node-moment?arch=source&distro=bookworm
Debian:13 / node-moment
Package
- Name
- node-moment
- Purl
- pkg:deb/debian/node-moment?arch=source&distro=trixie
Debian:14 / node-moment
Package
- Name
- node-moment
- Purl
- pkg:deb/debian/node-moment?arch=source&distro=forky