rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: High severity vulnerability that affects bson The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Vulnerability ID: GHSA-8462-q7x7-g2x4
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/mongodb/js-bson
Published: 2018-09-17
File: lib/bson/decimal128.js
Commit message: fix(decimal128): add basic guard against REDOS attacks

This is a naive approach to reducing the efficacy of a REDOS attack
against this module. A refactor of the regular expression or a
custom parser substitute would be ideal, however this solution
suffices as a stopgap until such work is completed.

Many thanks to James Davis who graciously alterted us to the
attack
Commit author: Matt Broadstone

Vulnerable version (before fix):
 Decimal128.fromString = function(string) {   // Trim the string   string = string.trim();    // Results   var stringMatch = string.match(PARSE_STRING_REGEXP);   var infMatch = string.match(PARSE_INF_REGEXP);

Fixed version (after fix):
 Decimal128.fromString = function(string) {   // Trim the string   string = string.trim();    // Naively prevent against REDOS attacks.   // TODO: implementing a custom parsing for this, or refactoring the regex would yield   //       further gains.   if (string.length >= 7000) {     throw new Error('' + string + ' not a valid Decimal128 string');   }    // Results   var stringMatch = string.match(PARSE_STRING_REGEXP);   var infMatch = string.match(PARSE_INF_REGEXP);

Patch:
patch: @@ -235,6 +235,13 @@ Decimal128.fromString = function(string) {
   // Trim the string
   string = string.trim();
 
+  // Naively prevent against REDOS attacks.
+  // TODO: implementing a custom parsing for this, or refactoring the regex would yield
+  //       further gains.
+  if (string.length >= 7000) {
+    throw new Error('' + string + ' not a valid Decimal128 string');
+  }
+
   // Results
   var stringMatch = string.match(PARSE_STRING_REGEXP);
   var infMatch = string.match(PARSE_INF_REGEXP);
path: lib/bson/decimal128.js
Vulnerability: OS command injection in git-diff-apply In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
Vulnerability ID: GHSA-84cm-v6jp-gjmr
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/kellyselden/git-diff-apply
Published: 2020-02-14
File: src/index.js
Commit message: spawn git clone

to prevent injecting a command
Commit author: Kelly Selden

Vulnerable version (before fix):
 const resolveConflicts = require('./resolve-conflicts'); const commitAndTag = require('./commit-and-tag'); const gitRemoveAll = require('./git-remove-all'); const createCustomRemote = require('./create-custom-remote');  const { isGitClean } = gitStatus; const { gitConfigInit } = gitInit; module.exports = async function gitDiffApply({     _tmpDir = await tmpDir();     tmpWorkingDir = _tmpDir;      await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);      // needed because we are going to be committing in here     await gitConfigInit({ cwd: _tmpDir });

Fixed version (after fix):
 const resolveConflicts = require('./resolve-conflicts'); const commitAndTag = require('./commit-and-tag'); const gitRemoveAll = require('./git-remove-all'); const createCustomRemote = require('./create-custom-remote'); const { runWithSpawn } = require('./run');  const { isGitClean } = gitStatus; const { gitConfigInit } = gitInit; module.exports = async function gitDiffApply({     _tmpDir = await tmpDir();     tmpWorkingDir = _tmpDir;      await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);      // needed because we are going to be committing in here     await gitConfigInit({ cwd: _tmpDir });

Patch:
patch: @@ -18,6 +18,7 @@ const resolveConflicts = require('./resolve-conflicts');
 const commitAndTag = require('./commit-and-tag');
 const gitRemoveAll = require('./git-remove-all');
 const createCustomRemote = require('./create-custom-remote');
+const { runWithSpawn } = require('./run');
 
 const { isGitClean } = gitStatus;
 const { gitConfigInit } = gitInit;
@@ -222,7 +223,7 @@ module.exports = async function gitDiffApply({
     _tmpDir = await tmpDir();
     tmpWorkingDir = _tmpDir;
 
-    await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);
+    await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);
 
     // needed because we are going to be committing in here
     await gitConfigInit({ cwd: _tmpDir });
path: src/index.js
Vulnerability: Moderate severity vulnerability that affects rack rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Vulnerability ID: GHSA-85r7-w5mv-c849
CWE: CWE-22
Severity score: 0
Project: https://github.com/rack/rack
Published: 2017-10-24
File: lib/rack/file.rb
Commit message: Prevent symlink path traversals

 * Closes CVE-2013-0262
Commit author: James Tucker

Vulnerable version (before fix):
 def _call(env)       path_info = Utils.unescape(env["PATH_INFO"])       parts = path_info.split SEPS        parts.inject(0) do |depth, part|         case part         when '', '.'           depth         when '..'           return fail(404, "Not Found") if depth - 1 < 0           depth - 1         else           depth + 1         end       end        @path = F.join(@root, *parts)        available = begin         F.file?(@path) && F.readable?(@path)

Fixed version (after fix):
 def _call(env)       path_info = Utils.unescape(env["PATH_INFO"])       parts = path_info.split SEPS        clean = []        parts.each do |part|         next if part.empty? || part == '.'         part == '..' ? clean.pop : clean << part       end        @path = F.join(@root, *clean)        available = begin         F.file?(@path) && F.readable?(@path)

Patch:
patch: @@ -41,19 +41,14 @@ def _call(env)
       path_info = Utils.unescape(env["PATH_INFO"])
       parts = path_info.split SEPS
 
-      parts.inject(0) do |depth, part|
-        case part
-        when '', '.'
-          depth
-        when '..'
-          return fail(404, "Not Found") if depth - 1 < 0
-          depth - 1
-        else
-          depth + 1
-        end
+      clean = []
+
+      parts.each do |part|
+        next if part.empty? || part == '.'
+        part == '..' ? clean.pop : clean << part
       end
 
-      @path = F.join(@root, *parts)
+      @path = F.join(@root, *clean)
 
       available = begin
         F.file?(@path) && F.readable?(@path)
path: lib/rack/file.rb
Vulnerability: SQL Injection in Geocoder sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Vulnerability ID: GHSA-864j-6qpp-cmrr
CWE: CWE-89
Severity score: 9.8
Project: https://github.com/alexreisner/geocoder
Published: 2020-06-10
File: lib/geocoder/sql.rb
Commit message: Sanitize lat/lon for SQL query.
Commit author: Alex Reisner

Vulnerable version (before fix):
 def approx_distance(latitude, longitude, lat_attr, lon_attr, options = {})     end      def within_bounding_box(sw_lat, sw_lng, ne_lat, ne_lng, lat_attr, lon_attr)       spans = "#{lat_attr} BETWEEN #{sw_lat} AND #{ne_lat} AND "       # handle box that spans 180 longitude       if sw_lng.to_f > ne_lng.to_f         spans + "(#{lon_attr} BETWEEN #{sw_lng} AND 180 OR " +         "#{lon_attr} BETWEEN -180 AND #{ne_lng})"       else         spans + "#{lon_attr} BETWEEN #{sw_lng} AND #{ne_lng}"       end     end 

Fixed version (after fix):
 def approx_distance(latitude, longitude, lat_attr, lon_attr, options = {})     end      def within_bounding_box(sw_lat, sw_lng, ne_lat, ne_lng, lat_attr, lon_attr)       spans = "#{lat_attr} BETWEEN #{sw_lat.to_f} AND #{ne_lat.to_f} AND "       # handle box that spans 180 longitude       if sw_lng.to_f > ne_lng.to_f         spans + "(#{lon_attr} BETWEEN #{sw_lng.to_f} AND 180 OR " +         "#{lon_attr} BETWEEN -180 AND #{ne_lng.to_f})"       else         spans + "#{lon_attr} BETWEEN #{sw_lng.to_f} AND #{ne_lng.to_f}"       end     end 

Patch:
patch: @@ -44,13 +44,13 @@ def approx_distance(latitude, longitude, lat_attr, lon_attr, options = {})
     end
 
     def within_bounding_box(sw_lat, sw_lng, ne_lat, ne_lng, lat_attr, lon_attr)
-      spans = "#{lat_attr} BETWEEN #{sw_lat} AND #{ne_lat} AND "
+      spans = "#{lat_attr} BETWEEN #{sw_lat.to_f} AND #{ne_lat.to_f} AND "
       # handle box that spans 180 longitude
       if sw_lng.to_f > ne_lng.to_f
-        spans + "(#{lon_attr} BETWEEN #{sw_lng} AND 180 OR " +
-        "#{lon_attr} BETWEEN -180 AND #{ne_lng})"
+        spans + "(#{lon_attr} BETWEEN #{sw_lng.to_f} AND 180 OR " +
+        "#{lon_attr} BETWEEN -180 AND #{ne_lng.to_f})"
       else
-        spans + "#{lon_attr} BETWEEN #{sw_lng} AND #{ne_lng}"
+        spans + "#{lon_attr} BETWEEN #{sw_lng.to_f} AND #{ne_lng.to_f}"
       end
     end
path: lib/geocoder/sql.rb
Vulnerability: Improper Input Validation in Automattic Mongoose Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Vulnerability ID: GHSA-8687-vv9j-hgph
CWE: CWE-20
Severity score: 9.1
Project: https://github.com/Automattic/mongoose
Published: 2019-10-22
File: lib/cast.js
Commit message: fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries

Fix #8222
Commit author: Valeri Karpov

Vulnerable version (before fix):
 module.exports = function cast(schema, obj, options, context) {     throw new Error('Query filter must be an object, got an array ', util.inspect(obj));   }    const paths = Object.keys(obj);   let i = paths.length;   let _keys;

Fixed version (after fix):
 module.exports = function cast(schema, obj, options, context) {     throw new Error('Query filter must be an object, got an array ', util.inspect(obj));   }    // bson 1.x has the unfortunate tendency to remove filters that have a top-level   // `_bsontype` property. Should remove this when we upgrade to bson 4.x. See gh-8222   if (obj.hasOwnProperty('_bsontype')) {     delete obj._bsontype;   }    const paths = Object.keys(obj);   let i = paths.length;   let _keys;

Patch:
patch: @@ -27,6 +27,12 @@ module.exports = function cast(schema, obj, options, context) {
     throw new Error('Query filter must be an object, got an array ', util.inspect(obj));
   }
 
+  // bson 1.x has the unfortunate tendency to remove filters that have a top-level
+  // `_bsontype` property. Should remove this when we upgrade to bson 4.x. See gh-8222
+  if (obj.hasOwnProperty('_bsontype')) {
+    delete obj._bsontype;
+  }
+
   const paths = Object.keys(obj);
   let i = paths.length;
   let _keys;
path: lib/cast.js
Vulnerability: Out-of-bounds Write in ChakraCore Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17048.
Vulnerability ID: GHSA-88cw-3m6x-49f7
CWE: CWE-787
Severity score: 7.5
Project: https://github.com/chakra-core/ChakraCore
Published: 2021-08-02
File: lib/Backend/Lower.cpp
Commit message: [CVE-2020-17054]
Commit author: Paul Leathers

Vulnerable version (before fix):
 void Lowerer::LowerLdFrameDisplay(IR::Instr *instr, bool doStackFrameDisplay)         if (instr->m_func != this->m_func && this->m_func->DoStackFrameDisplay())         {             StackSym * inlineeFrameDisplaySym = instr->m_func->GetLocalFrameDisplaySym();             Assert(inlineeFrameDisplaySym->IsAllocated());             InsertMove(IR::SymOpnd::New(inlineeFrameDisplaySym, TyMachReg, m_func), dstOpnd, instr);         }     } 

Fixed version (after fix):
 void Lowerer::LowerLdFrameDisplay(IR::Instr *instr, bool doStackFrameDisplay)         if (instr->m_func != this->m_func && this->m_func->DoStackFrameDisplay())         {             StackSym * inlineeFrameDisplaySym = instr->m_func->GetLocalFrameDisplaySym();             Assert((inlineeFrameDisplaySym && inlineeFrameDisplaySym->IsAllocated()) || this->m_func->IsLoopBody());             if (inlineeFrameDisplaySym && inlineeFrameDisplaySym->IsAllocated())             {                 InsertMove(IR::SymOpnd::New(inlineeFrameDisplaySym, TyMachReg, m_func), dstOpnd, instr);             }         }     } 

Patch:
patch: @@ -27152,8 +27152,11 @@ void Lowerer::LowerLdFrameDisplay(IR::Instr *instr, bool doStackFrameDisplay)
         if (instr->m_func != this->m_func && this->m_func->DoStackFrameDisplay())
         {
             StackSym * inlineeFrameDisplaySym = instr->m_func->GetLocalFrameDisplaySym();
-            Assert(inlineeFrameDisplaySym->IsAllocated());
-            InsertMove(IR::SymOpnd::New(inlineeFrameDisplaySym, TyMachReg, m_func), dstOpnd, instr);
+            Assert((inlineeFrameDisplaySym && inlineeFrameDisplaySym->IsAllocated()) || this->m_func->IsLoopBody());
+            if (inlineeFrameDisplaySym && inlineeFrameDisplaySym->IsAllocated())
+            {
+                InsertMove(IR::SymOpnd::New(inlineeFrameDisplaySym, TyMachReg, m_func), dstOpnd, instr);
+            }
         }
     }
path: lib/Backend/Lower.cpp
Vulnerability: Insecure Default Configuration in redbird Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.


## Recommendation

Upgrade to version 0.9.1 or later.
Vulnerability ID: GHSA-8948-ffc6-jg52
CWE: CWE-20
Severity score: 4.2
Project: https://github.com/OptimalBits/redbird
Published: 2019-06-06
File: lib/proxy.js
Commit message: Adding option to disable older SSL/TLS versions

Simply pass in "secureOptions" as you normally would to an https config object, and redbird will pass it along into the https proxy server.
Commit author: James Thomas

Vulnerable version (before fix):
 ReverseProxy.prototype.setupHttpsProxy = function (proxy, websocketsUpgrade, log     key: getCertData(sslOpts.key),     cert: getCertData(sslOpts.cert)   };    if (sslOpts.ca) {     ssl.ca = getCertData(sslOpts.ca, true);

Fixed version (after fix):
 ReverseProxy.prototype.setupHttpsProxy = function (proxy, websocketsUpgrade, log     key: getCertData(sslOpts.key),     cert: getCertData(sslOpts.cert)   };      // Allows the option to disable older SSL/TLS versions   if(sslOpts.secureOptions) {     ssl.secureOptions = sslOpts.secureOptions;   }    if (sslOpts.ca) {     ssl.ca = getCertData(sslOpts.ca, true);

Patch:
patch: @@ -252,6 +252,11 @@ ReverseProxy.prototype.setupHttpsProxy = function (proxy, websocketsUpgrade, log
     key: getCertData(sslOpts.key),
     cert: getCertData(sslOpts.cert)
   };
+  
+  // Allows the option to disable older SSL/TLS versions
+  if(sslOpts.secureOptions) {
+    ssl.secureOptions = sslOpts.secureOptions;
+  }
 
   if (sslOpts.ca) {
     ssl.ca = getCertData(sslOpts.ca, true);
path: lib/proxy.js
Vulnerability: Stored Cross-site Scripting in Microweber Microweber 1.2.11 and prior contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods.
Vulnerability ID: GHSA-8c76-mxv5-w4g8
CWE: CWE-79
Severity score: 6.8
Project: https://github.com/microweber/microweber
Published: 2022-03-16
File: src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
Commit message: Update SaveOptionApiController.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
  class SaveOptionApiController {     public function saveOption(Request $request) {          $cleanFromXss = true;         $option = $request->all();          // Allow for this keys         if (isset($option['option_key'])) {             if ($option['option_key'] == 'website_head') {                 $cleanFromXss = false;             }             if ($option['option_key'] == 'website_footer') {                 $cleanFromXss = false;             }         } 

Fixed version (after fix):
  class SaveOptionApiController {     public $whitelistedGroupKeys = [         'website' => [             'website_head',             'website_footer'         ]     ];      public function saveOption(Request $request)     {          $cleanFromXss = true;         $option = $request->all();          // Allow for this keys and groups         if (isset($option['option_key'])) {             foreach ($this->whitelistedGroupKeys as $group => $keys) {                 if ($option['option_group'] == $group) {                     foreach ($keys as $key) {                         if ($option['option_key'] == $key) {                             $cleanFromXss = false;                             break;                         }                     }                 }             }         } 

Patch:
patch: @@ -6,18 +6,30 @@
 
 class SaveOptionApiController
 {
-    public function saveOption(Request $request) {
+    public $whitelistedGroupKeys = [
+        'website' => [
+            'website_head',
+            'website_footer'
+        ]
+    ];
+
+    public function saveOption(Request $request)
+    {
 
         $cleanFromXss = true;
         $option = $request->all();
 
-        // Allow for this keys
+        // Allow for this keys and groups
         if (isset($option['option_key'])) {
-            if ($option['option_key'] == 'website_head') {
-                $cleanFromXss = false;
-            }
-            if ($option['option_key'] == 'website_footer') {
-                $cleanFromXss = false;
+            foreach ($this->whitelistedGroupKeys as $group => $keys) {
+                if ($option['option_group'] == $group) {
+                    foreach ($keys as $key) {
+                        if ($option['option_key'] == $key) {
+                            $cleanFromXss = false;
+                            break;
+                        }
+                    }
+                }
             }
         }
path: src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
Vulnerability: Denial of Service in https-proxy-agent Versions of `https-proxy-agent` before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to `Buffer()`.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability ID: GHSA-8g7p-74h8-hg48
CWE: CWE-125
Severity score: 9.1
Project: https://github.com/TooTallNate/node-https-proxy-agent
Published: 2018-07-27
File: index.js
Commit message: Use `Buffer.from()`

`new Buffer()` is deprecated and unsafe.
Commit author: Nathan Rajlich

Vulnerable version (before fix):
 HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {   var headers = Object.assign({}, proxy.headers);   if (proxy.auth) {     headers['Proxy-Authorization'] =       'Basic ' + new Buffer(proxy.auth).toString('base64');   }    // the Host header should only include the port

Fixed version (after fix):
 HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {   var headers = Object.assign({}, proxy.headers);   if (proxy.auth) {     headers['Proxy-Authorization'] =       'Basic ' + Buffer.from(proxy.auth).toString('base64');   }    // the Host header should only include the port

Patch:
patch: @@ -204,7 +204,7 @@ HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {
   var headers = Object.assign({}, proxy.headers);
   if (proxy.auth) {
     headers['Proxy-Authorization'] =
-      'Basic ' + new Buffer(proxy.auth).toString('base64');
+      'Basic ' + Buffer.from(proxy.auth).toString('base64');
   }
 
   // the Host header should only include the port
path: index.js
Vulnerability: Denial of Service in https-proxy-agent Versions of `https-proxy-agent` before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to `Buffer()`.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability ID: GHSA-8g7p-74h8-hg48
CWE: CWE-400
Severity score: 9.1
Project: https://github.com/TooTallNate/node-https-proxy-agent
Published: 2018-07-27
File: index.js
Commit message: Use `Buffer.from()`

`new Buffer()` is deprecated and unsafe.
Commit author: Nathan Rajlich

Vulnerable version (before fix):
 HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {   var headers = Object.assign({}, proxy.headers);   if (proxy.auth) {     headers['Proxy-Authorization'] =       'Basic ' + new Buffer(proxy.auth).toString('base64');   }    // the Host header should only include the port

Fixed version (after fix):
 HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {   var headers = Object.assign({}, proxy.headers);   if (proxy.auth) {     headers['Proxy-Authorization'] =       'Basic ' + Buffer.from(proxy.auth).toString('base64');   }    // the Host header should only include the port

Patch:
patch: @@ -204,7 +204,7 @@ HttpsProxyAgent.prototype.callback = function connect(req, opts, fn) {
   var headers = Object.assign({}, proxy.headers);
   if (proxy.auth) {
     headers['Proxy-Authorization'] =
-      'Basic ' + new Buffer(proxy.auth).toString('base64');
+      'Basic ' + Buffer.from(proxy.auth).toString('base64');
   }
 
   // the Host header should only include the port
path: index.js
Vulnerability: Path Traversal: 'dir/../../filename' in moment.locale ### Impact
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.

### Patches
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).

### Workarounds
Sanitize user-provided locale name before passing it to moment.js.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [moment repo](https://github.com/moment/moment)
Vulnerability ID: GHSA-8hfj-j24r-96c4
CWE: CWE-22
Severity score: 7.5
Project: https://github.com/moment/moment
Published: 2022-04-04
File: src/lib/locale/locales.js
Commit message: [bugfix] Avoid loading path-looking locales from fs
Commit author: Iskren Chernev

Vulnerable version (before fix):
 function chooseLocale(names) {     return globalLocale; }  function loadLocale(name) {     var oldLocale = null,         aliasedRequire; function loadLocale(name) {         locales[name] === undefined &&         typeof module !== 'undefined' &&         module &&         module.exports     ) {         try {             oldLocale = globalLocale._abbr;

Fixed version (after fix):
 function chooseLocale(names) {     return globalLocale; }  function isLocaleNameSane(name) {     // Prevent names that look like filesystem paths, i.e contain '/' or '\'     return name.match('^[^/\\\\]*$') != null; }  function loadLocale(name) {     var oldLocale = null,         aliasedRequire; function loadLocale(name) {         locales[name] === undefined &&         typeof module !== 'undefined' &&         module &&         module.exports &&         isLocaleNameSane(name)     ) {         try {             oldLocale = globalLocale._abbr;

Patch:
patch: @@ -62,6 +62,11 @@ function chooseLocale(names) {
     return globalLocale;
 }
 
+function isLocaleNameSane(name) {
+    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
+    return name.match('^[^/\\\\]*$') != null;
+}
+
 function loadLocale(name) {
     var oldLocale = null,
         aliasedRequire;
@@ -70,7 +75,8 @@ function loadLocale(name) {
         locales[name] === undefined &&
         typeof module !== 'undefined' &&
         module &&
-        module.exports
+        module.exports &&
+        isLocaleNameSane(name)
     ) {
         try {
             oldLocale = globalLocale._abbr;
path: src/lib/locale/locales.js