CVE-2026-39983

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

basic-ftp is an FTP client library for Node.js that prior to version 5.2.1 permitted FTP command injection through CRLF sequences embedded in file path arguments supplied to APIs including cd, remove, rename, uploadFrom, downloadTo, list, and removeDir. The protectWhitespace helper only stripped leading whitespace and left other inputs untouched, while FtpContext.send wrote the resulting string directly to the control socket and appended its own CRLF terminator, allowing a single call to be split into multiple FTP commands.

An attacker who can influence the path strings passed to these high-level methods can therefore inject arbitrary FTP commands against the remote server without authentication or user interaction, achieving impacts rated at CVSS 8.6 that include confidentiality loss, integrity compromise, and limited availability effects.

The vulnerability is addressed in release 5.2.1; the project published a corresponding security advisory and the fixing commit on GitHub that sanitizes path inputs before command construction.

EPSS rose from a low baseline to a peak of 0.0698 on 2026-04-16 shortly after disclosure before receding to the current value of 0.0204, indicating a transient increase in exploitation interest following public release of the details.