Skip to content
Fencer Vulns
high 7.5

CVE-2022-29244 json

npm packing does not respect root-level ignore files in workspaces

published 2022-06-02 4 y ago modified 2026-06-17 4 mo ago also GHSA-hj9c-8jmm-8c52 , EUVD-2022-6068

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Patch / fix

  • npm npm 8.11.0
  • npmjs npm 8.11.0
  • nodejs RHEL 9 1:16.16.0-1.el9_0
  • nodejs-nodemon RHEL 9 2.0.19-1.el9_0
  • npm RHEL 9 1:8.11.0-1.16.16.0.1.el9_0
  • nodejs-libs RHEL 9 1:16.16.0-1.el9_0
  • nodejs-full-i18n RHEL 9 1:16.16.0-1.el9_0

red hat advisories RHSA-2022:6595

  • nodejs16 SLE Module for Web and Scripting 15 SP3, openSUSE Leap 15.3 16.17.0-150300.7.9.1
  • nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.17.0-150400.3.6.1
  • nodejs16 SLE Module for Web and Scripting 12 16.17.0-8.9.1

suse advisories SUSE-SU-2022:3251-1SUSE-SU-2022:3250-1SUSE-SU-2022:3196-1

  • nodejs16 openSUSE Tumbleweed 16.17.0-1.1

opensuse advisories openSUSE-SU-2024:12280-1

  • nodejs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
  • npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
  • nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0

almalinux advisories ALSA-2022:6595

  • nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0

rocky linux advisories RLSA-2022:6595

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-29244 updated cvss 7.5

nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace

  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0
    fixed: vendor fix RHSA-2022:6595
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0 Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

4.00% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm npm
>=7.9.0, <8.11.0
8.11.0

Affected products

  • npm npm

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.