Cleartext Transmission of Sensitive Information in moment-timezone
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-319.
Summary
### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata pipeline, or potentially produce a tainted version of moment-timezone (practicality of such attacks is not proved) ### Patches Problem has been patched in version 0.5.35, patch should be applicable with minor modifications to all affected versions. The patch includes changing the FTP endpoint with an HTTPS endpoint. ### Workarounds Specify the exact version of tzdata (like `2014d`, full command being `grunt data:2014d`, then run the rest of the release tasks by hand), or just apply the patch before issuing the grunt command.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | moment-timezone (npm) | 0.1.0 to before 0.5.35 | 0.5.35 | Patch available | GHSA-v78c-4p63-2j6c |
- moment-timezone (npm) Vendor— Affected 0.1.0 to before 0.5.35 Fixed in 0.5.35 Patch available GHSA-v78c-4p63-2j6c
Remediation
- Fix · GHSA-v78c-4p63-2j6c moment-timezone (npm) Fixed in 0.5.35 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-v78c-4p63-2j6c
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences