p PatchFirst

CVE-2026-39983

CVE-2026-39983 · FTP Command Injection via CRLF in basic-ftp

This page contains facts from public vulnerability sources. Check the original advisory before updating.

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

CVSS 8.6 · High · EPSS 2.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • basic-ftp

    Versions
    • < 5.2.1: Affected

    No fix published

  • node-proxy-agents Debian:13

    Versions
    • 0~2024040606-6
    • 0~2024040606-6+deb13u1
    • 0~2025070717+~cs15.2.7-1
    • 0~2025070717+~cs15.3.7-1
    • 0~2025070717+~cs15.3.8-1
    • 0~2025070717+~cs15.3.8-2
    • 0~2025070717+~cs15.3.8-3
    • 0~2025070717+~cs16.2.9-1
    • 0~2025070717-1
    • 0~2025070717-2
    • 0~2025070717-3
    • 0~2025070717-4
    • 0~2025070717-5
    • 0~2025070717-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-proxy-agents Debian:14

    Versions
    • 0~2024040606-6
    • 0~2025070717+~cs15.2.7-1
    • 0~2025070717-1
    • 0~2025070717-2
    • 0~2025070717-3
    • 0~2025070717-4
    • 0~2025070717-5
    • 0~2025070717-6
    Affected ranges
    • ECOSYSTEM: < 0~2025070717+~cs15.3.7-1

    Update to 0~2025070717+~cs15.3.7-1

  • basic-ftp npm

    Versions
    • 5.2.0
    Affected ranges
    • SEMVER: ≥ 5.2.0, < 5.2.1

    Update to 5.2.1

  • node-proxy-agents Ubuntu:24.04:LTS

    Versions
    • 0~2023071921-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-proxy-agents Ubuntu:25.10

    Versions
    • 0~2024040606-5
    • 0~2024040606-6
    • 0~2025070717-1
    • 0~2025070717-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-proxy-agents Ubuntu:26.10

    Versions
    • 0~2025070717+~cs15.2.7-1build1
    • 0~2025070717+~cs15.3.8-1
    • 0~2025070717+~cs15.3.8-2
    • 0~2025070717+~cs15.3.8-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-proxy-agents Ubuntu:26.04:LTS

    Versions
    • 0~2025070717-2
    • 0~2025070717-6
    • 0~2025070717+~cs15.2.7-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →