WS-2022-0280

All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via "grunt data:2014d", where "2014d" stands for the version of the tzdata to be used from IANA's website, and Alice let'...