Command Injection in ascii-art
Summary
GHSA-9hqj-38j2-5jgm: Command Injection in ascii-art. Affects ascii-art versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ascii-art package is an npm package that allows users to generate ASCII art from text. It provides various functions and methods to create and manipulate ASCII art. However, versions of ascii-art before 1.4.4 are vulnerable to command injection.
Vulnerability Detail
The vulnerability arises when user input is passed into the argument of the ascii-art preview command without proper sanitization. An attacker can exploit this by injecting malicious commands into the input, leading to arbitrary command execution on the system. This can result in unauthorized access, data loss, or other malicious activities depending on the privileges of the user executing the command. The likely exploitation vector is when the ascii-art command is called programmatically using methods like execFile.
How To Fix
Minimum fixed version
1.4.4
This is the first release that contains the fix.
npm install ascii-art@1.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to ensure that user input is properly sanitized and validated before passing it as an argument to the ascii-art preview command. This can be done by implementing input validation and using techniques like parameterized queries or command escaping to prevent command injection.
Conclusion
The ascii-art package versions prior to 1.4.4 are vulnerable to command injection. It is crucial to update to the latest version or apply proper input validation and sanitization to prevent exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ascii-art →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data loss, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will analyze and alert you in real-time.
Yes, a proof of concept exploit has been provided in the vulnerability details. It demonstrates how an attacker can inject a command to create a malicious file on the system.
The recommended mitigation is to update to the latest version of the ascii-art package. Additionally, implementing proper input validation and sanitization can help prevent command injection attacks.
No, there is no CVE assigned to this vulnerability at the moment.
