Is CVE-2026-126345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126345 being exploited in the wild.

How severe is CVE-2026-126345?

Medium severity, with a CVSS score of 5.3, published 12 November 2026.

Which products and versions are affected?

Basic-Ftp ; basic-ftp (npm) <= 6.2.3, SEMVER:introduced=0,fixed=6.2.4; Patrick Juchli Basic-Ftp prior to 6.2.4.

Is there a fix for CVE-2026-126345?

Yes. basic-ftp (npm): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126345 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126345?

Check whether you run Basic-Ftp, basic-ftp (npm) or Patrick Juchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126345: basic-ftp MLSD parser prototype pollution

Q: Is there a fix for CVE-2026-126345?

Yes. basic-ftp (npm): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126345 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126345?

Check whether you run Basic-Ftp, basic-ftp (npm) or Patrick Juchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126345 · Severity: medium · CVSS 5.3 · Published 2026-11-12

basic-ftp is a Node.js FTP client library used to download and list files from FTP servers. A malicious or compromised FTP server can inject special property names like __proto__ into directory listings, causing the client to crash with a TypeError when parsing. Applications that do not handle this error will terminate under Node.js 15 and later.

Technologies: basic-ftp (npm), Patrick Juchli Basic-Ftp. Vendors: npm, Patrick Juchli.

Quick answers

Is CVE-2026-126345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126345 being exploited in the wild.
How severe is CVE-2026-126345?: Medium severity, with a CVSS score of 5.3, published 12 November 2026.
Which products and versions are affected?: Basic-Ftp <UNKNOWN>; basic-ftp (npm) <= 6.2.3, SEMVER:introduced=0,fixed=6.2.4; Patrick Juchli Basic-Ftp prior to 6.2.4.
Is there a fix for CVE-2026-126345?: Yes. basic-ftp (npm): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126345 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126345?: Check whether you run Basic-Ftp, basic-ftp (npm) or Patrick Juchli Basic-Ftp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

basic-ftp (npm): upgrade to 6.2.4 or later
```
npm install basic-ftp@6.2.4
```

Technical details

The MLSD directory listing parser in parseListMLSD.ts unsafely uses untrusted fact names from the FTP server as keys to look up handlers in a plain object dictionary without validating ownership, allowing prototype pollution via __proto__ or constructor properties. When such a property resolves, the code attempts to call Object.prototype as a function, throwing a TypeError that is not wrapped as an FTPError and propagates to callers. This requires either a compromised FTP server or an on-path attacker on plaintext FTP connections.

Affected products

Patrick Juchli basic-ftp prior to 6.2.4

Identifiers

CVE-2026-126345
GHSA-5pm8-86m8-9m6r

Timeline

2026-11-12: disclosed
2026-10-30: patched: Release v6.2.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.