CVEvulnerability
CVE-2022-29244
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-06-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
Affected configurations
• npmjs npm (>= 7.9.0 < 8.11.0)
• netapp ontap select deploy administration utility
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/nodejs/node/pull/43210 Patch, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v16.15.1 Release Notes, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v17.9.1 Release Notes, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v18.3.0 Release Notes, Third Party Advisory
- https://github.com/npm/cli/releases/tag/v8.11.0 Release Notes, Third Party Advisory
- https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52 Third Party Advisory
- https://github.com/npm/cli/tree/latest/workspaces/libnpmpack Product, Third Party Advisory
- https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish Product, Third Party Advisory
- https://github.com/npm/npm-packlist Product, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220722-0007/ Third Party Advisory
- https://github.com/nodejs/node/pull/43210 Patch, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v16.15.1 Release Notes, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v17.9.1 Release Notes, Third Party Advisory
- https://github.com/nodejs/node/releases/tag/v18.3.0 Release Notes, Third Party Advisory
- https://github.com/npm/cli/releases/tag/v8.11.0 Release Notes, Third Party Advisory
- https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52 Third Party Advisory
- https://github.com/npm/cli/tree/latest/workspaces/libnpmpack Product, Third Party Advisory
- https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish Product, Third Party Advisory
- https://github.com/npm/npm-packlist Product, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220722-0007/ Third Party Advisory