CVE-2026-39983: patrickjuchli basic-ftp FTP command injection via CRLF sequences

CVE-2026-39983 · Severity: high · CVSS 8.6 · Published 2026-04-09

basic-ftp is a software library used by Node.js applications to transfer files via the FTP protocol. A vulnerability in this library allows an attacker to inject unauthorized commands into an FTP session if the application uses untrusted user input for file paths. This could lead to unauthorized file deletion, data theft, or the creation of malicious directories on the connected FTP server.

Technologies: basic-ftp (npm), Red Hat Developer Hub, Red Hat Self-service automation portal. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-39983 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39983 being exploited in the wild.
How severe is CVE-2026-39983?
High severity, with a CVSS score of 8.6, published 9 April 2026.
Which products and versions are affected?
basic-ftp (npm) = 5.2.0, SEMVER:introduced=5.2.0,fixed=5.2.1; Red Hat Developer Hub affected; Red Hat Self-service automation portal affected.
Is there a fix for CVE-2026-39983?
Yes. basic-ftp (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39983 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39983?
Check whether you run basic-ftp (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • basic-ftp (npm): upgrade to 5.2.1 or later
    npm install basic-ftp@5.2.1

Technical details

A CRLF injection vulnerability exists in basic-ftp prior to version 5.2.1. The library's protectWhitespace() helper fails to sanitize carriage return (\r) and line feed (\n) characters in path parameters, while the FtpContext.send() method appends its own CRLF and writes directly to the control socket. An attacker providing a crafted path string can split a single intended FTP command into multiple commands. This allows for the execution of arbitrary FTP commands such as DELE, RETR, or MKD. The vulnerability affects high-level APIs including cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The issue is fixed in version 5.2.1 by rejecting paths containing control characters.

Affected products

  • patrickjuchli basic-ftp < 5.2.1
  • Red Hat Red Hat Developer Hub 1.8 affected
  • Red Hat Red Hat Developer Hub 1.9 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected
  • Red Hat Self-service automation portal 2 affected

Identifiers

  • CVE-2026-39983
  • GHSA-chqc-8p9q-pq6q

Timeline

  • 2026-04-08: patched: Version 5.2.1 released to address the vulnerability.
  • 2026-04-09: disclosed: Vulnerability disclosed via GitHub Security Advisory.
  • 2026-04-09: advisory: NVD published CVE-2026-39983.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.