CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
8.6
HIGH
CVSS 3.1
EPSS 2.2%
描述
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
如何修補 CVE-2026-39983
要修補 CVE-2026-39983,請將受影響套件升級到下列已修補版本。
- —未列出修補版本
- —升級至 5.2.1 或更新版本
CVE-2026-39983 正在被利用嗎?
低 — EPSS 為 2.2%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0
- >= 5.2.0, < 5.2.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |