[Shrinandan-N]

Summary

moment@2.15.1 loads locales with require('./locale/' + name) without sanitizing name, so a user-controlled locale can traverse out of the locale dir and require arbitrary .js files (CVE-2022-24785 / SNYK-JS-MOMENT-2440688, CWE-22). In this app the /import handler in routes/index.js passes the third CSV column of an uploaded file straight into moment.locale(locale).

Fix: pin moment to 2.29.4 (fix landed in 2.29.2; 2.29.4 also covers the later RFC2822 ReDoS, CVE-2022-31129) and update package-lock.json (lockfileVersion 2 preserved; only the moment entries changed).

End-to-end verification — ran the app (npm start, MongoDB 3.6) and POST /import with this CSV, where /tmp/evil/pwn.js logs TRAVERSAL EXECUTED:

Safe todo,2020-01-01,fr,LL
Evil todo,2020-01-01,../../../../../../../../../../tmp/evil/pwn,LL

moment	Server log for the "Evil todo" row
2.15.1 (before)	TRAVERSAL EXECUTED — arbitrary file was required
2.29.4 (this PR)	file not loaded; the bad locale is ignored

Valid locales still work on 2.29.4: "Safe todo" imports as Safe todo [1 janvier 2020].

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/4c4e10df534d47a4bd27fc737ef0a263
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/4c4e10df534d47a4bd27fc737ef0a263?variant=devin
Requested by: @Shrinandan-N

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	moment@​2.15.1 ⏵ 2.29.4		+21

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.