CVE-2026-39983
Description
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
basic-ftpnpm | >= 5.2.0, < 5.2.1 | 5.2.1 |
Affected products
1Patches
12ecc8e2c500cReject control character injection attempts using paths
1 file changed · +4 −0
src/Client.ts+4 −0 modified@@ -760,6 +760,10 @@ export class Client { * a given path to fix that issue for most cases. */ async protectWhitespace(path: string): Promise<string> { + // Reject CRLF injection attempts + if (/[\r\n\0]/.test(path)) { + throw new Error("Invalid path: Contains control characters"); + } if (!path.startsWith(" ")) { return path }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4bnvdPatchWEB
- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6qnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-chqc-8p9q-pq6qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-39983ghsaADVISORY
- github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.