moment.js Path Traversal via Crafted Non-String Locale Name

#!/usr/bin/env bash
# check_moment_cve2026_17495.sh
# Checks whether the installed moment.js version is vulnerable to CVE-2026-17495
# (path traversal via non-string locale name, affects 2.29.2 through 2.30.x)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Try to find moment version from node_modules
if [ -f "node_modules/moment/package.json" ]; then
  VERSION=$(node -e "console.log(require('./node_modules/moment/package.json').version)" 2>/dev/null)
elif command -v npm &>/dev/null; then
  VERSION=$(npm ls moment --json 2>/dev/null | node -e "
    const fs = require('fs');
    const data = JSON.parse(fs.readFileSync('/dev/stdin','utf8'));
    const deps = data.dependencies || {};
    if (deps.moment) { console.log(deps.moment.version); }
    else { process.exit(1); }
  " 2>/dev/null) || true
fi

if [ -z "${VERSION:-}" ]; then
  echo "UNKNOWN - moment.js not found in this project"
  exit 2
fi

echo "Detected moment.js version: $VERSION"

# Parse semver components
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)

# Vulnerable range: >= 2.29.2 and < 2.31.0
if [ "$MAJOR" -eq 2 ]; then
  if [ "$MINOR" -eq 29 ] && [ "$PATCH" -ge 2 ]; then
    echo "VULNERABLE - version $VERSION is in affected range (2.29.2 - 2.30.x)"
    exit 1
  elif [ "$MINOR" -eq 30 ]; then
    echo "VULNERABLE - version $VERSION is in affected range (2.29.2 - 2.30.x)"
    exit 1
  elif [ "$MINOR" -ge 31 ]; then
    echo "PATCHED - version $VERSION is >= 2.31.0"
    exit 0
  else
    echo "PATCHED - version $VERSION is below 2.29.2 (not affected by this CVE; check CVE-2022-24785 instead)"
    exit 0
  fi
else
  echo "UNKNOWN - unexpected major version $MAJOR"
  exit 2
fi