CVE-2022-29244CWE-200

npm packing does not respect root-level ignore files in workspaces

High · published June 13, 2022

CVSS v3.1
7.5
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.04004 · 90.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-06-13T13:40Z
EPSS history
Timeline
  • 13 JUN 13:40Z
    npm packing does not respect root-level ignore files in workspaces
    cvelistv5