CVE-2026-39983

OVERVIEW CVE-2026-39983 is an FTP command injection vulnerability in basic-ftp, a Node.js FTP client library versions prior to 5.2.1. The vulnerability exists in high-level path APIs including cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir() functions. Attackers can inject arbitrary FTP commands by embedding CRLF sequences (\r\n) in file path parameters, exploiting insufficient input sanitization in the protectWhitespace() helper function. SEVERITY This vulnerability carries a CVSS 3.1 score of 8.6 (High) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, meaning exploitation is straightforward. The impact is significant, enabling attackers to achieve partial confidentiality breaches, high integrity compromise through command execution, and partial availability impact. The vulnerability affects systems over the network without requiring special privileges or user involvement. EXPLOITATION STATUS There is currently no indication of active exploitation in the wild, with the vulnerability absent from the CISA Known Exploited Vulnerabilities catalog. Exploit code availability has not been publicly reported. Community attention appears limited, as reflected in the low EPSS score of 0.018, indicating this vulnerability ranks lower in prevalence relative to other disclosed CVEs. However, the relatively high FAUCET risk score of 52.0/100 suggests organizations should prioritize patching to version 5.2.1 to mitigate potential risk.