CVE-2026-39983

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39983
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39983.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-39983
Aliases
Downstream
Related
Published
2026-04-09T17:05:46.228Z
Modified
2026-05-28T03:54:41.745119929Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
FTP Command Injection via CRLF in basic-ftp
Details

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39983.json",
    "cwe_ids": [
        "CWE-93"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/patrickjuchli/basic-ftp

Affected ranges

Type
GIT
Repo
https://github.com/patrickjuchli/basic-ftp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ba40f9d60e1ff7b63de5d5bb272ae317e5382689

Affected versions

1.*
1.0.6
4.*
4.6.6
v1.*
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.2.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.15.0
v2.16.0
v2.16.1
v2.17.0
v2.17.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.7.1
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.9.0
v2.9.1
v2.9.2
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.5.0
v3.6.0
v3.7.0
v3.7.1
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.2.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39983.json"