Command Injection in moment-timezone

Description

All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection.

Recommendation

Update the moment-timezone package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.1.0, < 0.5.35
• Patched version(s): 0.5.35

References

• GHSA-56x4-j7p9-fcf9

Related Issues

• Cleartext Transmission of Sensitive Information in moment-timezone - Vulnerability
• chromedriver Command Injection vulnerability - CVE-2023-26156
• json-logic-js Command Injection vulnerability - CVE-2021-4329
• Command Injection in soletta-dev-app - Vulnerability

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

moment-timezone