moment — Vulnerabilities & Security Advisories 3

Moment is an image manipulation library primarily used for parsing, validating, formatting, and displaying dates in JavaScript applications. Historically, it has been susceptible to remote code execution, cross-site scripting, and privilege escalation vulnerabilities due to insecure parsing of date strings and improper input validation. Notable security characteristics include its widespread adoption in legacy systems, which extends its attack surface. In 2020, multiple critical CVEs were disclosed, including RCE flaws through crafted date inputs. Despite its popularity, the library has faced criticism for security concerns, leading to recommendations for alternatives like Luxon or date-fns, especially in environments handling untrusted date inputs.