npm package report

Is basic-ftp safe?

5 known vulnerabilities, worst severity CRITICAL.

cvss

9.1

how bad it is if exploited, out of 10

epss

0.70%

chance of exploitation in the next 30 days

xyz score

4.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-5rq4-664w-9x2c, the advisory selected below

// advisories

GHSA-5rq4-664w-9x2c

CRITICALCVE-2026-27699

The basic-ftp library contains a path traversal vulnerability in the downloadToDir() method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (../) that cause files to be written outside the intended download directory.

Affected: < 5.2.0
Fixed in: 5.2.0
Weakness: CWE-22
Published: 2026-02-25
Source: github

GHSA NVD MITRE reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 00:38 UTC. The most recent advisory here was published 2026-05-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is basic-ftp safe? npm package security report | CyberXYZ