{"action":"Upgrade basic-ftp to 5.2.2 or later.","affected":[{"fixed":"5.2.2","introduced":"0"}],"component":"basic-ftp","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.2.2"],"ghsa_id":"GHSA-6v7q-wjvx-w8wg","id":"tcs_01M5KF7ZZXSV0AE3CXFDWPV0H8","modified_at":"2026-09-10T03:50:43.425256836Z","published_at":"2026-04-10T20:18:23Z","references":["https://osv.dev/vulnerability/GHSA-6v7q-wjvx-w8wg","https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg","https://github.com/patrickjuchli/basic-ftp/commit/20327d35126e57e5fdbaae79a4b65222fbadc53c","https://github.com/patrickjuchli/basic-ftp","https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.2"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-6v7q-wjvx-w8wg","url":"https://osv.dev/vulnerability/GHSA-6v7q-wjvx-w8wg"}],"summary":"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands"}