{"cve":"CVE-2022-29244","nvd":{"published":"2022-06-13T14:15:09.027","modified":"2026-06-17T04:39:54.333","status":"Modified","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://github.com/nodejs/node/pull/43210","https://github.com/nodejs/node/releases/tag/v16.15.1","https://github.com/nodejs/node/releases/tag/v17.9.1","https://github.com/nodejs/node/releases/tag/v18.3.0","https://github.com/npm/cli/releases/tag/v8.11.0"],"products":["netapp:ontap_select_deploy_administration_utility","npmjs:npm"],"source":"nvd","synced_at":"2026-10-19T21:32:39.174919249+00:00"},"epss":{"cve":"CVE-2022-29244","score":0.04004,"percentile":0.90543,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-hj9c-8jmm-8c52","url":"https://osv.dev/vulnerability/GHSA-hj9c-8jmm-8c52","summary":"Packing does not respect root-level ignore files in workspaces","modified":"2023-11-08T04:09:11.980528Z","packages":[{"ecosystem":"npm","name":"npm","purl":"pkg:npm/npm","ranges":[">=7.9.0 <8.11.0"],"fixed":["8.11.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}