GHSA-9hqj-38j2-5jgm
Command Injection in ascii-art
GHSA-9hqj-38j2-5jgm is a vulnerability with no CVSS score yet in ascii-art, published September 1, 2020. No source lists public exploit code. Fixed in ascii-art 1.4.4.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.4ascii-art +1 more
Description
Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command.
Example Proof of concept:
ascii-art preview 'doom"; touch /tmp/malicious; echo "'
Given that the input is passed on the command line and none of the api methods are vulnerable to this, the likely exploitation vector is when the ascii-art comment is being called programmatically using something like execFile.
Recommendation
Update to version 1.4.4 or later.
Affected packages
What each source reports
GitHub AdvisoriesNo score
Command Injection in ascii-art
Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command.
Example Proof of concept:
ascii-art preview 'doom"; touch /tmp/malicious; echo "'
Given that the input is passed on the command line and none of the api methods are vulnerable to this, the likely exploitation vector is when the ascii-art comment is being called programmatically using something like execFile.
Recommendation
Update to version 1.4.4 or later.
- Record
GHSA-9hqj-38j2-5jgm- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVNo score
Command Injection in ascii-art
Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview command.
Example Proof of concept:
ascii-art preview 'doom"; touch /tmp/malicious; echo "'
Given that the input is passed on the command line and none of the api methods are vulnerable to this, the likely exploitation vector is when the ascii-art comment is being called programmatically using something like execFile.
Recommendation
Update to version 1.4.4 or later.
- Record
GHSA-9hqj-38j2-5jgm- Weakness
- CWE-77
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.