CVE-2022-29244: npm packing does not respect root-level ignore files in workspaces
A flaw was found in npm. This security issue occurs because the npm pack ignores root-level ".gitignore" and ".npmignore" file exclusion directives when run in a workspace or with a workspace flag (for example, --workspaces, --workspace=<name>). Anyone who has run 'npm pack' or 'npm publish' inside a workspace has published files into the npm registry they did not intend to include. This flaw exposes sensitive information to an unauthorized user or an attacker.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-29244?
CVE-2022-29244 is a security vulnerability in npm that allows ignoring certain exclusion directives.
How does the security issue in CVE-2022-29244 occur?
The security issue in CVE-2022-29244 occurs because npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag.
Who is affected by CVE-2022-29244?
Anyone who has run npm pack or npm publish inside a workspace may be affected by CVE-2022-29244.
What is the severity of CVE-2022-29244?
The severity of CVE-2022-29244 is high with a CVSS score of 7.5.
How can I fix CVE-2022-29244?
To fix CVE-2022-29244, update Node.js to version 16.15.1, 17.19.1, or 18.3.0, or update the nodejs package to version 1:16.16.0-1.el9_0.