Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[CVE-2026-39983: HIGH] FTP client basic-ftp for Node.js (<5.2.1) allows FTP command injection via CRLF sequences (\r\n) in file paths, exposing systems to cyber attacks. Update to 5.2.1 for a fix.#cve,CVE-2026-39983,#cybersecurity https://cvefind.com/CVE-2026-39983
Post summary
The post reports a high‑severity command injection vulnerability in basic‑ftp <5.2.1 and advises updating to version 5.2.1 to remediate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | patrickjuchli | basic-ftp | - | node.js | - |