GHSA-9hqj-38j2-5jgm Command Injection in ascii-art
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-9hqj-38j2-5jgm?
GHSA-9hqj-38j2-5jgm is a vulnerability in ascii-art, published on 1 Sep 2020.
Official description
Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command.
Example Proof of concept:
ascii-art preview 'doom"; touch /tmp/malicious; echo "'
Given that the input is passed on the command line and none of the api methods are vulnerable to this, the likely exploitation vector is when the ascii-art comment is being called programmatically using something like execFile.
Recommendation
Update to version 1.4.4 or later.
Which versions are affected by GHSA-9hqj-38j2-5jgm?
2 open source packages ship an affected version, including ascii-art.
| Package | Affected | Fixed in |
|---|---|---|
ascii-art npm | All versions | 1.4.4 |
ascii-art npm | All versions | 1.4.4 |
How do I fix GHSA-9hqj-38j2-5jgm?
Upgrade ascii-art to 1.4.4 or later.
Is GHSA-9hqj-38j2-5jgm being exploited?
There is no known exploitation of GHSA-9hqj-38j2-5jgm in the wild and no public exploit code.