GHSA-chqc-8p9q-pq6q: basic-ftp has FTP Command Injection via CRLF
Summary`basic-ftp` version `5.2.0` allows FTP command injection via CRLF sequences (`\r\n`) in file path parameters passed to high-level path APIs such as `cd()`, `remove()`, `rename()`, `uploadFrom()`, `downloadTo()`, `list()`, and `removeDir()`. The library's `protectWhitespace()` helper only handles leading spaces and returns other paths unchanged, while `FtpContext.send()` writes the resulting command string directly to the control socket with `\r\n` appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands.Affected product| Product | Affected versions | Fixed version |
| --- | --- | --- |
| basic-ftp (npm) | 5.2.0 (confirmed) | no fix available as of 2026-04-04 |Vulnerability detailsCWE: `CWE-93` - Improper Neutralization of CRLF Sequences ('CRLF Injection')CVSS 3.1: `8.6` (`High`)Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L`Affected component: `dist/Client.js`, all path-handling methods via `protectWhitespace()` and `send()`The vulnerability exists because of two interacting code patterns:**1. Inadequate path sanitization in `protectWhitespace()` (line 677):**This function only handles leading whitespace. It does not strip or reject `\r` (0x0D) or `\n` (0x0A) characters anywhere in the path string.**2. Direct socket write in `send()` (FtpContext.js line 177):**The `send()` method appends `\r\n` to the command and writes directly to the TCP socket. If the command string already contains `\r\n` sequences (from unsanitized path input), the FTP server interprets them as command delimiters, causing the single intended command to be split into multiple commands.**Affected methods** (all call `protectWhitespace()` → `send()`):`cd(path)` → `CWD ${path}``remove(path)` → `DELE ${path}``list(path)` → `LIST ${path}``downloadTo(localPath, remotePath)` → `RETR ${remotePath}``uploadFrom(localPath, remotePath)` → `STOR ${remotePath}``rename(srcPath, destPath)` → `RNFR ${srcPath}` / `RNTO ${destPath}``removeDir(path)` → `RMD ${path}`Technical impactAn attacker who controls file path parameters can inject arbitrary FTP protocol commands, enabling:**Arbitrary file deletion**: Inject `DELE /critical-file` to delete files on the FTP server**Directory manipulation**: Inject `MKD` or `RMD` commands to create/remove directories**File exfiltration**: Inject `RETR` commands to trigger downloads of unintended files**Server command execution**: On FTP servers supporting `SITE EXEC`, inject system commands**Session hijacking**: Inject `USER`/`PASS` commands to re-authenticate as a different user**Service disruption**: Inject `QUIT` to terminate the FTP session unexpectedlyThe attack is realistic in applications that accept user input for FTP file paths — for example, web applications that allow users to specify files to download from or upload to an FTP server.Proof of concept**Prerequisites:****Mock FTP server (ftp-server-mock.js):****Exploit (poc.js):****Running the PoC:****Expected output on mock server:**This command trace was reproduced against the published `basic-ftp@5.2.0`
package on Linux with a local mock FTP server. The injected `DELE` commands are
received as distinct FTP commands, confirming that CRLF inside path parameters
is not neutralized before socket write.Mitigation**Immediate workaround**: Sanitize all path inputs before passing them to basic-ftp:**Recommended fix for basic-ftp**: The `protectWhitespace()` function (or a new validation layer) should reject or strip `\r` and `\n` characters from all path inputs:References[npm package: basic-ftp](https://www.npmjs.com/package/basic-ftp)[GitHub repository](https://github.com/patrickjuchli/basic-ftp)[Vulnerable source: Client.js protectWhitespace()](https://github.com/patrickjuchli/basic-ftp/blob/master/src/Client.ts)[Vulnerable source: FtpContext.js send()](https://github.com/patrickjuchli/basic-ftp/blob/master/src/FtpContext.ts)[CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)[OWASP: CRLF Injection](https://owasp.org/www-community/vulnerabilities/CRLF_Injection)
CVSS v3.1: 8.6