logo

Database

Business information leak In nodejs

Description

A flaw was found in npm. This security issue occurs because the npm pack ignores root-level ".gitignore" and ".npmignore" file exclusion directives when run in a workspace or with a workspace flag (for example, --workspaces, --workspace=). Anyone who has run 'npm pack' or 'npm publish' inside a workspace has published files into the npm registry they did not intend to include. This flaw exposes sensitive information to an unauthorized user or an attacker.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-292442. NVD-2022-292443. OSV-2022-292444. GHSA-hj9c-8jmm-8c525. GCVE-2022-29244

References

1. https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c522. https://github.com/nodejs/node/pull/432103. https://github.com/nodejs/node/releases/tag/v16.15.14. https://github.com/nodejs/node/releases/tag/v17.9.15. https://github.com/nodejs/node/releases/tag/v18.3.06. https://github.com/npm/cli7. https://github.com/npm/cli/releases/tag/v8.11.08. https://github.com/npm/cli/tree/latest/workspaces/libnpmpack9. https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish10. https://github.com/npm/npm-packlist11. https://security.netapp.com/advisory/ntap-20220722-0007

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.