patrickjuchli basic-ftp up to 6.2.2 FTPContext FTPContext.send exceptional condition

Summaryinfo

A vulnerability was found in patrickjuchli basic-ftp up to 6.2.2. It has been classified as problematic. The impacted element is the function FTPContext.send of the component FTPContext. The manipulation leads to exceptional condition. This vulnerability is listed as CVE-2026-126346. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in patrickjuchli basic-ftp up to 6.2.2. It has been rated as problematic. This issue affects the function FTPContext.send of the component FTPContext. The manipulation with an unknown input leads to a exceptional condition vulnerability. Using CWE to declare the problem leads to CWE-755. The product does not handle or incorrectly handles an exceptional condition. Impacted is availability. The summary by CVE is:

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-126346 since 11/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 6.2.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• patrickjuchli

Name

• basic-ftp

Version

• 6.2.0
• 6.2.1
• 6.2.2

Website

• Product: https://github.com/patrickjuchli/basic-ftp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion