GHSA-56x4-j7p9-fcf9

What it actually does

The flaw is a command injection issue in affected versions of the moment-timezone npm package. If an application passes attacker-controlled input into vulnerable moment-timezone functionality that reaches operating system command execution, the attacker may be able to inject shell metacharacters or additional commands. Successful exploitation can result in arbitrary command execution with the privileges of the application process. In downstream packaged deployments such as affected Bitnami GitLab distributions, impact depends on whether the vulnerable package is present and reachable through application code or maintenance workflows.

Why it matters to the business

Applications or packaged products that include the vulnerable moment-timezone version may be exposed to server-side command execution if untrusted input can reach the affected code path. Business consequences can include service disruption, unauthorized access to application data, credential theft from the runtime environment, lateral movement from the compromised host, and deployment of malware or backdoors. The issue is older, not listed in CISA KEV, and has no stated exploit maturity in the provided data, which lowers immediate known exploitation urgency; however, command injection flaws remain high-impact and should be remediated wherever the vulnerable package is still deployed.

How an attack unfolds

An attacker first identifies an application or packaged deployment that uses a vulnerable version of moment-timezone. They then look for an exposed feature, API, background job, import process, or administrative workflow that accepts timezone-related or otherwise package-processed input. If that input is passed unsafely into the vulnerable command execution path, the attacker supplies crafted characters such as command separators, shell substitutions, or redirection syntax to append their own operating system commands. When the application processes the malicious value, those commands execute under the application's service account. The attacker may then run reconnaissance commands, retrieve secrets from environment variables or configuration files, establish persistence, download additional tooling, or use the host as a foothold for further access.

How to fix it

Upgrade moment-timezone to version 0.5.35 or later. For Bitnami GitLab packaged deployments, upgrade to version 13.2.10 or later, or to a currently supported release if possible. Rebuild and redeploy containers, serverless artifacts, and application bundles so the fixed dependency is actually present at runtime. Regenerate lockfiles where needed and ensure transitive dependencies are resolved to the patched version. If immediate upgrade is not possible, restrict access to affected functionality, validate and allowlist timezone-related input, prevent shell metacharacters from reaching command execution contexts, run the application with least-privilege permissions, and apply egress controls to reduce post-exploitation impact.

How to confirm the fix worked

Confirm dependency versions using package manifests, lockfiles, SBOMs, and runtime inspection. For npm applications, check package-lock.json, yarn.lock, pnpm-lock.yaml, node_modules/moment-timezone/package.json, and build artifacts to verify moment-timezone is 0.5.35 or later. For Bitnami GitLab images or appliances, verify the deployed product version is 13.2.10 or later and that older images are not still running. Run software composition analysis against repositories and built containers, not only source code. Where safe and authorized, test exposed input points with benign command-injection probes that do not execute harmful actions, and confirm they are rejected, escaped, or not executed. Review CI/CD caches and base images to ensure vulnerable versions are not reintroduced.

Typical attack path

1. Identify an application, service, or packaged product that includes a vulnerable moment-timezone version.
2. Find an endpoint, job, plugin, import function, or administrative workflow that accepts input later handled by the vulnerable package.
3. Submit crafted input containing shell metacharacters or command payloads.
4. Trigger server-side processing of the malicious input.
5. Execute arbitrary operating system commands as the application process user.
6. Collect environment variables, configuration secrets, tokens, or application data.
7. Optionally deploy a web shell, reverse shell, cron job, or other persistence mechanism and pivot to adjacent systems.

How to detect it

Look for evidence that the application process, especially Node.js or a packaged GitLab service, spawned unexpected operating system commands. Useful sources include application access logs, application error logs, Node.js process logs, web server logs, container stdout/stderr, endpoint detection telemetry, Linux auditd logs, shell history where applicable, process creation logs, DNS logs, proxy logs, and network flow records. Focus on requests containing shell metacharacters or encoded command payloads, followed by child processes such as sh, bash, curl, wget, nc, python, perl, or powershell. Review for outbound connections to unfamiliar hosts immediately after suspicious requests. On Linux hosts and containers, check for newly created files in temporary directories, unauthorized cron entries, modified startup scripts, unexpected SSH keys, and downloaded binaries. Since no specific public exploit indicators are provided, detection should combine vulnerable-version exposure with generic command-injection and post-exploitation telemetry.

• moment-timezone@0.5.34
• moment-timezone@0.5.33
• moment-timezone@0.5.32
• moment-timezone@0.5.31
• moment-timezone@0.5.30
• node_modules/moment-timezone/package.json
• "moment-timezone": "0.5.34"
• "moment-timezone": "0.5.33"
• ;id
• ; whoami
• ; uname -a
• |whoami
• `whoami`
• $(whoami)
• /bin/sh -c
• /bin/bash -c
• curl http://
• wget http://
• nc -e
• bash -i >& /dev/tcp/
• /tmp/.
• /var/tmp/.
• crontab -e
• /etc/cron.d/
• authorized_keys

What your security team should do

• Inventory all applications, containers, and packaged products that include moment-timezone or affected Bitnami GitLab versions.
• Prioritize internet-facing, multi-tenant, CI/CD-adjacent, or high-privilege deployments for upgrade first.
• Upgrade moment-timezone to 0.5.35 or later and Bitnami GitLab to 13.2.10 or later; prefer current supported versions where feasible.
• Search source, lockfiles, SBOMs, and container layers for vulnerable package versions and enforce dependency policy gates in CI/CD.
• Harden runtime environments with least-privilege service accounts, read-only filesystems where practical, restricted outbound network access, and secrets isolation.
• Review logs and host telemetry for evidence of command execution, suspicious child processes spawned by Node.js, unexpected downloads, reverse shells, or persistence artifacts.
• If suspicious activity is found, preserve forensic evidence, rotate exposed credentials, rebuild affected hosts or containers from trusted images, and investigate lateral movement.