Read the docs
TI-2026-28837 Aliases CVE-2026-39983GHSA-chqc-8p9q-pq6q

FTP Command Injection via CRLF in basic-ftp

Priority HIGH 76CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02223 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial basic-ftp (patrickjuchli): 5.2.1basic-ftp (npm): 5.2.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patrickjuchlibasic-ftpbefore 5.2.15.2.1Patch availableCNA
—basic-ftp (npm)5.2.0 to before 5.2.15.2.1Patch availableGHSA-chqc-8p9q-pq6q
  • basic-ftp Vendorpatrickjuchli Affected before 5.2.1 Fixed in 5.2.1 Patch available CNA
  • basic-ftp (npm) Vendor— Affected 5.2.0 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-chqc-8p9q-pq6q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:patrickjuchli:basic-ftp:*:*:*:*:*:node.js:*:*before 5.2.1Vulnerablepatrickjuchli
  • cpe:2.3:a:patrickjuchli:basic-ftp:*:*:*:*:*:node.js:*:* Versions before 5.2.1 Vulnerable ·patrickjuchli

Remediation

  • Fix · CNA basic-ftp (patrickjuchli) Fixed in 5.2.1
  • Fix · GHSA-chqc-8p9q-pq6q basic-ftp (npm) Fixed in 5.2.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Self-service automation portal 2AffectedNo fix yet
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Not affected: 4 products
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39983
  2. 2026-10-03 Alias added: GHSA-chqc-8p9q-pq6q

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-22075 Basic FTP has Path Traversal Vulnerability in its downloadToDir() method CVSS 3.1CRITICAL 9.8
  • TI-2026-29925 basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences