How severe is GHSA-v78c-4p63-2j6c?

No CVSS score has been assigned to GHSA-v78c-4p63-2j6c yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-v78c-4p63-2j6c?

GHSA-v78c-4p63-2j6c affects the following packages: moment-timezone (npm). Ecosystems affected: npm.

How do I fix GHSA-v78c-4p63-2j6c?

Update moment-timezone to 0.5.35 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v78c-4p63-2j6c is resolved across your whole dependency graph.

How do I detect GHSA-v78c-4p63-2j6c in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for moment-timezone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-v78c-4p63-2j6c if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-v78c-4p63-2j6c actively exploited in the wild?

No public exploit code has been indexed for GHSA-v78c-4p63-2j6c yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-v78c-4p63-2j6c published, and has it been updated?

GHSA-v78c-4p63-2j6c was published on August 30, 2022. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

Cleartext Transmission of Sensitive Information in moment-timezoneGHSA-v78c-4p63-2j6c

Fix: moment/moment-timezone@7915ac5

GHSA-v78c-4p63-2j6c is a security vulnerability in moment-timezone. A fix is available for moment-timezone — see the affected versions and patch details below.

Published

Aug 30, 2022

Updated

Aug 30, 2022

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Aug 30, 2022 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

11Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

moment-timezonenpm

24.6Mdownloads / week

Description

Impact

if Alice uses grunt data (or grunt release) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website
and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata pipeline, or potentially produce a tainted version of moment-timezone (practicality of such attacks is not proved)

Patches

Problem has been patched in version 0.5.35, patch should be applicable with minor modifications to all affected versions. The patch includes changing the FTP endpoint with an HTTPS endpoint.

Workarounds

Specify the exact version of tzdata (like 2014d, full command being grunt data:2014d, then run the rest of the release tasks by hand), or just apply the patch before issuing the grunt command.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`moment-timezone`	≥ 0.1.0&&< 0.5.35	0.5.35`npm install moment-timezone@0.5.35`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for moment-timezone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update moment-timezone to 0.5.35 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v78c-4p63-2j6c is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata pipeline, or potentially produce a tainted version of moment-timezone (practicality of such attacks is not proved) ### Patches Problem has been patched in version 0.5.35, patch should be applicable with minor modifications to all affected versions. The patch includes changing the FTP endpoin

O3 Security · Impact-Aware SCA

Is GHSA-v78c-4p63-2j6c in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works