basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF     sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(),     uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles     leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command     string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split     one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1. (CVE-2026-39983)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF
    sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(),
    uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles
    leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command
    string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split
    one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1. (CVE-2026-39983)

ID	Name	Product	Family	Type	Severity
306131	Linux Distros Unpatched Vulnerability : CVE-2026-39983	Nessus	Misc.	Local	high
440088	SCA: security update for basic-ftp (GHSA-chqc-8p9q-pq6q)	Tenable Cloud Security	SCA Checks	Local	high
440088	SCA: security update for basic-ftp (GHSA-chqc-8p9q-pq6q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-39983

high

Tenable Plugins

high

high

high