Home

Description

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

PUBLISHED Reserved 2026-04-08 | Published 2026-04-09 | Updated 2026-04-09 | Assigner GitHub_M




HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Problem types

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Product status

< 5.2.1
affected

References

github.com/...ic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q exploit

github.com/...ic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q

github.com/...ommit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b

github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1

cve.org (CVE-2026-39983)

nvd.nist.gov (CVE-2026-39983)

Download JSON