CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29244.json",
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type: GIT
Repo: https://github.com/nodejs/node
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

177064d0aee4a331eef93e3667963c02f0b94333

Fixed

49362efd5b39f31a14260612422109e130068d08

Fixed

cd98cfbdddfa95b75706674ddc56011c1c3fbfe3

Affected versions

v0.*

v0.0.1

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.1.0

v0.1.1

v0.1.10

v0.1.100

v0.1.101

v0.1.102

v0.1.103

v0.1.104

v0.1.11

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.33

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.1.90

v0.1.91

v0.1.92

v0.1.93

v0.1.94

v0.1.95

v0.1.96

v0.1.97

v0.1.98

v0.1.99

v0.10.0

v0.10.1

v0.10.10

v0.10.11

v0.10.12

v0.10.13

v0.10.14

v0.10.15

v0.10.16

v0.10.17

v0.10.18

v0.10.19

v0.10.2

v0.10.20

v0.10.21

v0.10.22

v0.10.23

v0.10.24

v0.10.25

v0.10.26

v0.10.27

v0.10.28

v0.10.29

v0.10.3

v0.10.30

v0.10.31

v0.10.32

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.10

v0.11.11

v0.11.12

v0.11.13

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.11.8

v0.11.9

v0.2.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.5-rc1

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.13

v0.8.14

v0.8.15

v0.8.16

v0.8.17

v0.8.18

v0.8.19

v0.8.2

v0.8.20

v0.8.21

v0.8.22

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.10

v0.9.11

v0.9.12

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

v1.*

v1.0.0

v1.0.0-release

v1.0.1

v1.0.1-release

v1.0.2

v1.0.2-release

v1.0.3

v1.0.4

v1.1.0

v1.2.0

v1.3.0

v1.4.1

v1.4.2

v1.4.3

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.6.4

v1.7.0

v1.7.1

v1.8.1

v16.*

v16.0.0

v16.1.0

v16.10.0

v16.11.0

v16.11.1

v16.12.0

v16.13.0

v16.13.1

v16.13.2

v16.14.0

v16.14.1

v16.14.2

v16.15.0

v16.2.0

v16.3.0

v16.4.0

v16.4.1

v16.4.2

v16.5.0

v16.6.0

v16.6.1

v16.6.2

v16.7.0

v16.8.0

v16.9.0

v16.9.1

v17.*

v17.0.0

v17.0.1

v17.1.0

v17.2.0

v17.3.0

v17.3.1

v17.4.0

v17.5.0

v17.6.0

v17.7.0

v17.7.1

v17.7.2

v17.8.0

v17.9.0

v18.*

v18.0.0

v18.1.0

v18.2.0

v2.*

v2.0.0

v2.0.1

v2.0.2

v2.1.0

v2.2.0

v2.2.1

v2.3.0

v2.3.1

v2.3.2

v2.3.3

v2.3.4

v2.4.0

v2.5.0

v3.*

v3.0.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29244.json"

Git / github.com/npm/cli

Affected ranges

Type: GIT
Repo: https://github.com/npm/cli
Events: Fixed

d60cfbcb43745705fd418fc2a7b8b427c6611911

Introduced

13843f489401d918e7f1a41ed1ff636fc3feb603

Fixed

d60cfbcb43745705fd418fc2a7b8b427c6611911

Affected versions

@npmcli/arborist-v5.*

@npmcli/arborist-v5.0.0

@npmcli/arborist@4.*

@npmcli/arborist@4.2.1

@npmcli/arborist@4.3.0

@npmcli/arborist@4.3.1

@npmcli/arborist@5.*

@npmcli/arborist@5.0.0

arborist-v5.*

arborist-v5.0.0

arborist-v5.0.1

arborist-v5.0.2

arborist-v5.0.3

arborist-v5.0.4

arborist-v5.0.5

arborist-v5.0.6

arborist-v5.1.0

arborist-v5.1.1

arborist-v5.2.0

libnpmaccess-v6.*

libnpmaccess-v6.0.0

libnpmaccess-v6.0.1

libnpmaccess-v6.0.2

libnpmaccess-v6.0.3

libnpmaccess@5.*

libnpmaccess@5.0.1

libnpmaccess@6.*

libnpmaccess@6.0.0

libnpmdiff-v4.*

libnpmdiff-v4.0.0

libnpmdiff-v4.0.1

libnpmdiff-v4.0.2

libnpmdiff-v4.0.3

libnpmdiff@4.*

libnpmdiff@4.0.0

libnpmexec-v4.*

libnpmexec-v4.0.0

libnpmexec-v4.0.1

libnpmexec-v4.0.2

libnpmexec-v4.0.3

libnpmexec-v4.0.4

libnpmexec-v4.0.5

libnpmexec@3.*

libnpmexec@3.0.3

libnpmexec@4.*

libnpmexec@4.0.0

libnpmfund-v3.*

libnpmfund-v3.0.0

libnpmfund-v3.0.1

libnpmfund-v3.0.2

libnpmfund@3.*

libnpmfund@3.0.0

libnpmhook-v8.*

libnpmhook-v8.0.0

libnpmhook-v8.0.1

libnpmhook-v8.0.2

libnpmhook-v8.0.3

libnpmhook@7.*

libnpmhook@7.0.1

libnpmhook@8.*

libnpmhook@8.0.0

libnpmorg-v4.*

libnpmorg-v4.0.0

libnpmorg-v4.0.1

libnpmorg-v4.0.2

libnpmorg-v4.0.3

libnpmorg@3.*

libnpmorg@3.0.1

libnpmorg@4.*

libnpmorg@4.0.0

libnpmpack-v4.*

libnpmpack-v4.0.0

libnpmpack-v4.0.1

libnpmpack-v4.0.2

libnpmpack-v4.0.3

libnpmpack-v4.1.0

libnpmpack@3.*

libnpmpack@3.1.0

libnpmpack@4.*

libnpmpack@4.0.0

libnpmpublish-v6.*

libnpmpublish-v6.0.0

libnpmpublish-v6.0.1

libnpmpublish-v6.0.2

libnpmpublish-v6.0.3

libnpmpublish-v6.0.4

libnpmpublish@5.*

libnpmpublish@5.0.1

libnpmpublish@6.*

libnpmpublish@6.0.0

libnpmsearch-v5.*

libnpmsearch-v5.0.0

libnpmsearch-v5.0.1

libnpmsearch-v5.0.2

libnpmsearch-v5.0.3

libnpmsearch@4.*

libnpmsearch@4.0.1

libnpmsearch@5.*

libnpmsearch@5.0.0

libnpmteam-v4.*

libnpmteam-v4.0.0

libnpmteam-v4.0.1

libnpmteam-v4.0.2

libnpmteam-v4.0.3

libnpmteam@3.*

libnpmteam@3.0.1

libnpmteam@4.*

libnpmteam@4.0.0

libnpmversion-v3.*

libnpmversion-v3.0.0

libnpmversion-v3.0.1

libnpmversion-v3.0.2

libnpmversion-v3.0.3

libnpmversion-v3.0.4

libnpmversion@3.*

libnpmversion@3.0.0

v7.*

v7.10.0

v7.11.1

v7.11.2

v7.12.0

v7.12.1

v7.13.0

v7.14.0

v7.15.0

v7.15.1

v7.16.0

v7.17.0

v7.18.0

v7.18.1

v7.19.0

v7.19.1

v7.20.0

v7.20.1

v7.20.2

v7.20.3

v7.20.4

v7.20.5

v7.20.6

v7.21.0

v7.21.1

v7.22.0

v7.23.0

v7.24.0

v7.24.1

v7.24.2

v7.9.0

v8.*

v8.0.0

v8.1.0

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.10.0

v8.2.0

v8.3.0

v8.3.1

v8.3.2

v8.4.0

v8.4.1

v8.5.0

v8.5.1

v8.5.2

v8.5.3

v8.5.4

v8.5.5

v8.6.0

v8.7.0

v8.8.0

v8.9.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29244.json"