FTP Command Injection Vulnerability in basic-ftp by Patrick Juchli

CVE-2026-39983

What is CVE-2026-39983?

The basic-ftp library, an FTP client for Node.js, is susceptible to an FTP command injection vulnerability. This flaw arises from unvalidated input in file path parameters that are sent to various high-level path APIs, such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). Attackers can exploit this by injecting CRLF sequences into file paths, thereby manipulating the command structure. The helper function protectWhitespace() only mitigates leading spaces, leaving other path manipulations unguarded. Consequently, FtpContext.send() directly writes these tampered command strings to the control socket, allowing attackers to divide a single FTP command into multiple unintended commands. This vulnerability was addressed in version 5.2.1.

References