CVE-2022-29244

npm/npm CVE-2022-29244: high 7.5

Packing does not respect root-level ignore files in workspaces

Action: Upgrade npm to 8.11.0 or later.

npm i npm@8.11.0

Affected

Fixed versions

Sources

• osv: GHSA-hj9c-8jmm-8c52
• https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
• https://nvd.nist.gov/vuln/detail/CVE-2022-29244
• https://github.com/nodejs/node/pull/43210
• https://github.com/nodejs/node/releases/tag/v16.15.1
• https://github.com/nodejs/node/releases/tag/v17.9.1
• https://github.com/nodejs/node/releases/tag/v18.3.0
• https://github.com/npm/cli
• https://github.com/npm/cli/releases/tag/v8.11.0
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
• https://github.com/npm/npm-packlist
• https://security.netapp.com/advisory/ntap-20220722-0007

CVE-2022-29244 · published 2022-06-02T15:37:27Z · modified 2023-11-08T04:09:11.980528Z · JSON