CVE-2022-24785: Path Traversal in Moment.js
Vulnerability summary
CVE-2022-24785 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 13.84% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 14% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 2Timeline
- 04-04-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CVSS metrics
9 scores · 8 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
13.84%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Decrease -0.06 pp
From 13.90% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-27Path Traversal: 'dir/../../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat70 products
- ceph< 2:16.2.10-94.el8cp | < 2:16.2.10-94.el9cp
- ceph-base< 2:16.2.10-94.el8cp | < 2:16.2.10-94.el9cp
- ceph-base-debuginfo< 2:16.2.10-94.el8cp | < 2:16.2.10-94.el9cp
- ceph-common< 2:16.2.10-94.el8cp | < 2:16.2.10-94.el9cp
- ceph-common-debuginfo< 2:16.2.10-94.el8cp | < 2:16.2.10-94.el9cp
Chainguard2 products
- wazuh-dashboard-security-plugin< 4.14.6-r5
- wazuh-dashboard-security-plugin-fips< 4.14.6-r2
Debian2 products
- node-moment< 2.29.2+ds-1
- debian_linuxEOL10.0
Ubuntu2 products
- nikolaAll versions (No fix recorded)
- node-momentAll versions (No fix recorded) | < 2.20.1+ds-1ubuntu0.1 | < 2.24.0+ds-2ubuntu0.1 | < 2.29.1+ds-3ubuntu0.2
Fedoraproject1 product
- fedoraEOL35 | 36
Moment1 product
- moment≥ 1.0.1, < 2.29.2
Momentjs1 product
- moment≥ 1.0.1, < 2.29.2
Netapp1 product
Npm1 product
- moment< 2.29.2
NuGet1 product
- Moment.js< 2.29.2
Tenable1 product
- tenable.sc< 5.21.0
11 vendors · 83 products
References
126 links- github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4ARTICLEREPORTWEBAdvisoryVendor Advisory
lists.debian.org/debian-lts-announce/2023/01/msg00035.htmlMailing ListWEBARTICLEThird Party Advisory
Show all 100 references
Showing 100 of 126.