PT-2022-6672 · Npm+6 · Npm+6

Published 2022-06-02 · Updated 2025-09-29 · CVE-2022-29244

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions npm versions 7.9.0 through 7.13.0 npm version 7.13.0 and earlier

Description The issue is related to the npm pack command ignoring root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag. This may have caused users to publish files into the npm registry that they did not intend to include. The problem is associated with information disclosure.

Recommendations For npm versions 7.9.0 through 7.13.0, upgrade to the latest, patched version of npm v8.11.0 by running: npm i -g npm@latest. For users of Node.js versions v16.15.1, v17.19.1, and v18.3.0, no additional action is required as these versions include the patched v8.11.0 version of npm.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALSA-2022:6595

ALSA-2022_6595

ALSA-2025_16880

ALT-PU-2022-2225

BDU:2023-03309

CVE-2022-29244

GHSA-HJ9C-8JMM-8C52

OPENSUSE-SU-2022_3250-1

OPENSUSE-SU-2022_3251-1

OPENSUSE-SU-2024:12280-1

RHSA-2022:6595

RHSA-2022_6595

RLSA-2022:6595

SUSE-SU-2022:3196-1

SUSE-SU-2022:3250-1

SUSE-SU-2022:3251-1

SUSE-SU-2022_3196-1

SUSE-SU-2022_3250-1

SUSE-SU-2022_3251-1

Affected Products

Alt Linux

Almalinux

Red Hat

Red Os

Rocky Linux

Suse

Npm

References · 79

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29244.json · Exploit
• https://github.com/nodejs/node/pull/43210 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:3250-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-6595.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-6595.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:6595 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3251-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3196-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:6595 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29244 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29244 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03309 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12280-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29244 · Security Note