Affected: npm: basic-ftp

## Summary

`basic-ftp` version `5.2.0` allows FTP command injection via CRLF sequences (`\r\n`) in file path parameters passed to high-level path APIs such as `cd()`, `remove()`, `rename()`, `uploadFrom()`, `downloadTo()`, `list()`, and `removeDir()`. The library's `protectWhitespace()` helper only handles leading spaces and returns other paths unchanged, while `FtpContext.send()` writes the resulting command string directly to the control socket with `\r\n` appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands.

## Affected product

| Product | Affected versions | Fixed version | | --- | --- | --- | | basic-ftp (npm) | 5.2.0 (confirmed) | no fix available as of 2026-04-04 |

## Vulnerability details

- CWE: `CWE-93` - Improper Neutralization of CRLF Sequences ('CRLF Injection') - CVSS 3.1: `8.6` (`High`) - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L` - Affected component: `dist/Client.js`, all path-handling methods via `protectWhitespace()` and `send()`

The vulnerability exists because of two interacting code patterns:

**1. Inadequate path sanitization in `protectWhitespace()` (line 677):**

```javascript async protectWhitespace(path) { if (!path.startsWith(" ")) { return path; // No sanitization of \r\n characters } const pwd = await this.pwd(); const absolutePathPrefix = pwd.endsWith("/") ? pwd : pwd + "/"; return absolutePathPrefix + path; } ```

This function only handles lead…