CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale() function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorized access to files. As a result, an attacker could potentially manipulate file paths, leading to unintended file access or the execution of malicious code on the server.

Moderate: A path traversal vulnerability exists in the moment JavaScript library when specially crafted non-string input is passed to the moment.locale() function. This flaw could allow an attacker to access or create files outside of intended directories on systems where user-provided input is directly used by moment.locale() in server-side npm deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, implement strict input validation to ensure that all user-supplied data passed to the moment.locale() function is a string. This operational control prevents the processing of crafted non-string objects that could lead to path traversal.