GHSA-9hqj-38j2-5jgm Command Injection in ascii-art

• npm ascii-art: < 1.4.4 → fixed in 1.4.4

Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. Example Proof of concept: `ascii-art preview 'doom"; touch /tmp/malicious; echo "'` Given that the input is passed on the command line and none of the api methods are vulnerable to this, the likely exploitation vector is when the ascii-art comment is being called programmatically using something like `execFile`. Recommendation Update to version 1.4.4 or later.