Affected: patrickjuchli basic-ftp, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Self-service automation portal 2

basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.

Affected: npm: basic-ftp

## Summary

`basic-ftp` version `5.2.0` allows FTP command injection via CRLF sequences (`\r\n`) in file path parameters passed to high-level path APIs such as `cd()`, `remove()`, `rename()`, `uploadFrom()`, `downloadTo()`, `list()`, and `removeDir()`. The library's `protectWhitespace()` helper only handles leading spaces and returns other paths unchanged, while `FtpContext.send()` writes the resulting command string directly to the control socket with `\r\n` appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands.

## Affected product

| Product | Affected versions | Fixed version | | --- | --- | --- | | basic-ftp (npm) | 5.2.0 (confirmed) | no fix available as of 2026-04-04 |

## Vulnerability details

- CWE: `CWE-93` - Improper Neutralization of CRLF Sequences ('CRLF Injection') - CVSS 3.1: `8.6` (`High`) - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L` - Affected component: `dist/Client.js`, all path-handling methods via `protectWhitespace()` and `send()`

The vulnerability exists because of two interacting code patterns:

**1. Inadequate path sanitization in `protectWhitespace()` (line 677):**

```javascript async protectWhitespace(path) { if (!path.startsWith(" ")) { return path; // No sanitization of \r\n characters } const pwd = await this.pwd(); const absolutePathPrefix = pwd.endsWith("/") ? pwd : pwd + "/"; return absolutePathPrefix + path; } ```

This function only handles lead…