1. Home
  2. Vulnerabilities
  3. CVE-2022-29244

CVE-2022-29244

CVSS v3.1 7.5 (High)
75% Progress
CVSS v2.0 5 (Medium)
50% Progress
EPSS 0.20 % (57th)
0.20% Progress
Affected Products 2
Advisories 7
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Weaknesses
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-NVD-noinfo
CVE Status
PUBLISHED
CNA
GitHub, Inc.
Published Date
2022-06-13 14:15:09
(2 years ago)
Updated Date
2022-10-27 16:25:40
(23 months ago)

Affected Products

Netapp

Npmjs

Configuration #1

    CPE23 From Up To
  Npmjs Npm from 7.9.0 version and prior 8.11.0 version cpe:2.3:a:npmjs:npm >= 7.9.0 < 8.11.0

Configuration #2

    CPE23 From Up To
  Netapp Ontap Select Deploy Administration Utility cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-