CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces

High 7.5 Published 13 Jun 2022 Updated 23 Apr 2025

npm pack fails to respect root ignore files in workspaces, potentially exposing unintended files in published packages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-29244?

CVE-2022-29244 is a high-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 13 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Weakness: CWE-200

Which versions are affected by CVE-2022-29244?

2 open source packages ship an affected version, including npm. It affects 2 products.

Package	Affected	Fixed in
`npm` npm	From `7.9.0`	`8.11.0`
`npm` npm	From `7.9.0`	`8.11.0`

Linux distribution packages (1)

nodejs16 openSUSE:Tumbleweed All versions 16.17.0-1.1

Products include Netapp Ontap Select Deploy Administration Utility, Npmjs Npm.

How do I fix CVE-2022-29244?

Upgrade npm to 8.11.0 or later.

Is CVE-2022-29244 being exploited?

There is no known exploitation of CVE-2022-29244 in the wild and no public exploit code.

All Netapp Ontap Select Deploy Administration Utility vulnerabilities

Sources

Also known as GHSA-hj9c-8jmm-8c52, UBUNTU-CVE-2022-29244, openSUSE-SU-2024:12280-1.