→

GHSA-chqc-8p9q-pq6q: basic-ftp has FTP Command Injection via CRLF

Summary

basic-ftp version 5.2.0 allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands.

Affected product

| Product | Affected versions | Fixed version | | --- | --- | --- | | basic-ftp (npm) | 5.2.0 (confirmed) | no fix available as of 2026-04-04 |

Vulnerability details

CWE: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSS 3.1: 8.6 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected component: dist/Client.js, all path-handling methods via protectWhitespace() and send()

The vulnerability exists because of two interacting code patterns:

1. Inadequate path sanitization in protectWhitespace() (line 677):

async protectWhitespace(path) {
    if (!path.startsWith(" ")) {
        return path;  // No sanitization of \r\n characters
    }
    const pwd = await this.pwd();
    const absolutePathPrefix = pwd.endsWith("/") ? pwd : pwd + "/";
    return absolutePathPrefix + path;
}

This function only handles leading whitespace. It does not strip or reject \r (0x0D) or \n (0x0A) characters anywhere in the path string.

Miggo Vulnerability Database

→

GHSA-chqc-8p9q-pq6q

GHSA-chqc-8p9q-pq6q:

8.6

CVSS Score

3.1

-

CVSS Score

-

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
basic-ftp	npm	= 5.2.0	5.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CRLF injection (CWE-93) in the basic-ftp npm package. The root cause is the protectWhitespace function in src/Client.ts, which failed to sanitize or reject path strings containing CRLF (\r\n) characters. This function is used by several other public methods in the Client class to handle file paths. An attacker could provide a specially crafted path containing CRLF sequences to these methods, which would then be passed to the FtpContext.send() method. The send() method appends another \r\n and writes the resulting string to the FTP command socket. This allows the attacker to inject arbitrary FTP commands. The provided patch fixes the vulnerability by adding a check in protectWhitespace to throw an error if the path contains control characters like \r or \n. The functions cd, remove, rename, uploadFrom, downloadTo, list, and removeDir are all affected as they use the vulnerable protectWhitespace function.

Vulnerable functions

Client.protectWhitespace

src/Client.ts

This function is responsible for sanitizing path strings. Before the patch, it did not check for CRLF characters, allowing an attacker to inject additional FTP commands into any function that uses it for path sanitization.

Client.cd

src/Client.ts

This function is vulnerable because it uses the unsanitized path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.remove

src/Client.ts

This function is vulnerable because it uses the unsanitized path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.rename

src/Client.ts

This function is vulnerable because it uses the unsanitized paths in FTP commands. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.uploadFrom

src/Client.ts

This function is vulnerable because it uses the unsanitized remote path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.downloadTo

src/Client.ts

This function is vulnerable because it uses the unsanitized remote path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.list

src/Client.ts

This function is vulnerable because it uses the unsanitized path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Client.removeDir

src/Client.ts

This function is vulnerable because it uses the unsanitized path in an FTP command. It calls `protectWhitespace` which, prior to the fix, did not remove CRLF characters, thus allowing command injection.

Vulnerability Intelligence
Miggo AI

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.