CVE-2026-39983

HighCVSS 8.6

Published: 09/04/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.19%

80th percentile - higher than 80% of all known CVEs

Summary

The basic-ftp library for Node.js prior to version 5.2.1 is vulnerable to FTP command injection via CRLF sequences in file path parameters. An attacker can exploit this to execute arbitrary FTP commands on the server.

Risk Assessment

The risk involves potential takeover of the FTP session by an attacker, leading to unauthorized access, modification, or deletion of files on the FTP server.

Recommendation

Immediately update the basic-ftp library to version 5.2.1 or later, which includes a fix for the FTP command injection vulnerability.

Other vulnerabilities in basic-ftp

CVE-2026-44240High
The vulnerability in basic-ftp prior to version 5.3.1 allows for client-side denial of service when parsing multiline FTP control responses. A malicious FTP server can send an unterminated response, leading to excessive memory and CPU usage.

Original NVD description (English source)

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.