Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by GitHub_M

CVE-2026-39983FTP Command Injection via CRLF in basic-ftp

High 8.6

In plain English

A high-severity security flaw in basic-ftp from patrickjuchli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)2.2%top 17.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13node-proxy-agentsno fix listedDEBIAN-CVE-2026-39983
Debian:14node-proxy-agents0~2025070717+~cs15.3.7-1DEBIAN-CVE-2026-39983
Ubuntu:24.04:LTSnode-proxy-agentsno fix listedUBUNTU-CVE-2026-39983
Ubuntu:25.10node-proxy-agentsno fix listedUBUNTU-CVE-2026-39983
Ubuntu:26.04:LTSnode-proxy-agentsno fix listedUBUNTU-CVE-2026-39983
Ubuntu:26.10node-proxy-agentsno fix listedUBUNTU-CVE-2026-39983
npmbasic-ftp5.2.1GHSA-chqc-8p9q-pq6q

Affected products (as reported)

VendorProductVersions
patrickjuchli basic-ftp < 5.2.1

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References