GHSA-6v7q-wjvx-w8wg

What it actually does

The flaw is an incomplete carriage-return/line-feed (CRLF) injection defense in the basic-ftp npm package. If an application passes attacker-controlled values into FTP credentials or directory-creation operations, an attacker can embed line breaks that terminate the intended FTP command and inject additional raw FTP protocol commands. This can allow unauthorized FTP actions under the privileges of the configured FTP session, such as creating, deleting, renaming, uploading, downloading, or changing files and directories if the FTP server account permits those commands.

Why it matters to the business

Applications that use vulnerable versions of basic-ftp can be tricked into issuing unintended FTP commands, which may lead to unauthorized file changes, data exposure, content tampering, service disruption, or loss of integrity in workflows that rely on FTP transfers. Because this is a library-level issue, risk depends on whether products using it accept untrusted FTP usernames, passwords, host inputs, paths, or directory names. The issue is not currently listed in CISA KEV and no mature public exploit is indicated, but the high CVSS score and ease of protocol-level abuse make remediation important, especially for systems that automate uploads, backups, publishing, integrations, or file exchange.

How an attack unfolds

An attacker first finds an application or service that uses basic-ftp to connect to an FTP server and allows user-controlled values to reach FTP credentials or MKD directory names. The attacker supplies a crafted value containing CRLF characters followed by additional FTP commands. When the vulnerable library builds and sends the FTP command, the embedded line break causes the FTP server to interpret the attacker-supplied text as one or more separate commands. The FTP server then executes those commands using the permissions of the authenticated FTP account. Depending on the account privileges and server configuration, the attacker may manipulate files, create directories, overwrite content, retrieve data, alter deployment artifacts, or disrupt FTP-backed business processes.

How to fix it

Upgrade basic-ftp to version 5.2.2 or later. For npm-based projects, update package.json and lockfiles, then rebuild and redeploy affected applications. If immediate upgrade is not possible, prevent untrusted input from reaching FTP usernames, passwords, remote paths, and directory names; reject or strip CR, LF, URL-encoded CRLF, and other control characters; enforce strict allowlists for FTP paths and directory names; and limit FTP account permissions to the minimum required. Review applications that wrap basic-ftp indirectly through other packages and update transitive dependencies where applicable.

How to confirm the fix worked

Confirm that dependency inventories, package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml no longer resolve basic-ftp to a vulnerable version and show basic-ftp 5.2.2 or later. Run software composition analysis against built artifacts and containers, not only source repositories. Exercise relevant FTP workflows with test inputs containing CRLF characters and verify they are rejected or safely encoded rather than producing additional FTP commands. Review FTP server-side logs to confirm that expected operations still work after upgrade and that injected command sequences are not accepted.

Typical attack path

1. Identify an application or integration that uses the vulnerable basic-ftp npm package.
2. Find an input path where FTP username, password, or directory name values are influenced by an external user or upstream data source.
3. Submit a crafted value containing CRLF characters followed by additional FTP protocol commands.
4. Trigger the application workflow that initiates the FTP connection or MKD operation.
5. Cause the FTP server to parse the injected content as separate FTP commands.
6. Use the FTP account's permissions to read, write, rename, delete, or alter files and directories.

How to detect it

Investigate both application logs and FTP server logs. Look for FTP commands containing embedded CRLF sequences, unexpected commands immediately following USER, PASS, or MKD, failed or unusual authentication attempts with malformed usernames, and directory names that appear to contain multiple FTP commands. Review FTP server command logs for suspicious use of DELE, RMD, RNFR, RNTO, STOR, RETR, SITE, CWD, or MKD commands that do not match expected application behavior. Check web/API logs for input values containing raw CR/LF characters or URL-encoded CRLF sequences such as %0d%0a that precede FTP activity. For forensic review, correlate application requests to outbound FTP sessions and inspect any unusual file creation, deletion, renaming, or transfer events performed by service FTP accounts.

• %0d%0a
• %0D%0A
• \r\nUSER
• \r\nPASS
• \r\nMKD
• \r\nCWD
• \r\nDELE
• \r\nRMD
• \r\nRNFR
• \r\nRNTO
• \r\nSTOR
• \r\nRETR
• \r\nSITE
• USER .*\r\n
• PASS .*\r\n
• MKD .*\r\n
• Unexpected FTP command after USER
• Unexpected FTP command after PASS
• Unexpected FTP command after MKD

What your security team should do

• Prioritize upgrading all direct and transitive uses of basic-ftp to 5.2.2 or later.
• Inventory applications that use FTP automation, file exchange, publishing, backups, or deployment pipelines and determine whether they depend on basic-ftp.
• Identify whether untrusted users or external systems can influence FTP credentials, remote paths, or directory names in affected applications.
• Add input validation that rejects CR, LF, and encoded CRLF sequences in FTP-related fields even after applying the vendor fix.
• Reduce FTP account privileges, disable unnecessary FTP commands where supported, and isolate FTP-accessible directories.
• Monitor FTP server logs for unusual command sequences, unexpected MKD activity, file deletion, renaming, uploads, downloads, or commands appearing immediately after USER, PASS, or MKD operations.
• Rotate FTP credentials if logs show suspicious injected commands or unauthorized file activity.