Executive brief
ascii-art is a Node.js library for rendering ASCII art. Versions before 1.4.4 allow command injection when user-supplied input is passed to the preview command, potentially allowing attackers to execute arbitrary system commands if the library is used programmatically with untrusted input.
Technical details
The vulnerability is a command injection (CWE-77) in the ascii-art preview command that occurs when user input is passed unsanitized to shell execution. While the command-line interface requires the input to be passed on the command line, the primary exploitation vector is programmatic use via Node.js methods like execFile() where untrusted user input can be injected. An attacker can break out of the intended command context and execute arbitrary shell commands. The vulnerability was patched in version 1.4.4.
Affected products
- ascii-art ascii-art <1.4.4
Timeline
- 2018-08-05: disclosed
- 2020-09-01: patched: Version 1.4.4 released