CVE-2026-126345

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

GHSA-5PM8-86M8-9M6R basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

Summary basic-ftp's MLSD directory-listing parser src/parseListMLSD.ts looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "proto" resolves this lookup to...

npm: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

npm: basic-ftp: Uncaught TypeError in MLSD directory-listing parser via proto fact name causes DoS in Client.list vulnerability discovered by ? in WordPress npm basic-ftp versions = 6.2.3...

EUVD-2026-124723

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

CVE-2026-126345

The basic-ftp Node.js FTP client is vulnerable to a Denial of Service (DoS) in its MLSD directory-listing parser (specifically in src/parseListMLSD.ts). Versions prior to 6.2.4 fail to verify that fact names received from an FTP server are own properties of the factHandlersByName dictionary. An a...

CVE-2026-126345: patrickjuchli basic-ftp: basic-ftp is an FTP client for Node.js

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

PT-2026-146065

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

CVE-2023-45198

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

EUVD-2004-2759

Malware in sbrugna...

EUVD-2006-2174

Malware in sbrugna...

EUVD-2023-49505

Malicious code in bioql PyPI...

CVE-2023-45198

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

Authentication flaw

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

CVE-2023-45198

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

CVE-2023-45198

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

CVE-2023-45198

CVE-2023-45198 affects ftpd before NetBSD-ftpd 20230930 and tnftpd before 20231001, enabling leakage of host filesystem information prior to authentication via MLSD/MLST. Red Hat/EUVD entries corroborate the issue. Remediation is to upgrade to NetBSD-ftpd 20231001 or later (or apply equivalent ve...

CVE-2023-45198: Undefined Security Weakness

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...

PT-2023-29452

Name of the Vulnerable Software and Affected Versions ftpd versions prior to 20230930 tnftpd versions prior to 20231001 Description The issue allows information about the host filesystem to be leaked before authentication via an MLSD or MLST command. Recommendations For ftpd versions prior to...

CVE-2023-45198

ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd the portable version of NetBSD ftpd before 20231001 is also vulnerable...