Command Injection in ascii-art

Description

Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command.

Recommendation

Update the ascii-art package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.4.2
• Patched version(s): 1.4.4

References

• GHSA-9hqj-38j2-5jgm
• hackerone.com
• www.npmjs.com
• CWE-77
• OWASP 2021-A3

Related Issues

• Command Injection in cocos-utils - Vulnerability
• Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability
• Command Injection in marsdb - Vulnerability
• Command Injection in soletta-dev-app - Vulnerability

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

ascii-art