This might be a false positive, but package-lock.json around line 3516 looked worth a second pair of eyes.
CVE-2026-27699 (CRITICAL): The project depends on basic-ftp 5.0.5, which is vulnerable to a path traversal flaw (CWE-22) in the downloadToDir() method. When downloading files, a malicious or compromised FTP server can return directory listings whose filenames contain '../' traversal sequences, causing files to be written outside the intended download directory. Impact: an attacker controlling the FTP server gains arbitrary file write capability on the host — they can overwrite application source code, config files, ~/.ssh/authorized_keys, cron jobs, or startup scripts, which commonly escalates to full remote code execution. Exploitation requires no credentials or user interaction beyond the app initiating an FTP transfer to a server the attacker controls, so risk is CRITICAL. Fix: upgrade basic-ftp to >= 5.2.0, which validates that resolved download paths remain within the target directory.
Something like this might fix it:
Recommended fix: upgrade the dependency. Run `npm install basic-ftp@^5.2.0` so npm updates package.json AND regenerates package-lock.json with the correct resolved URL and integrity hash (do not hand-edit the lockfile).
--- a/package.json
+++ b/package.json
@@
"dependencies": {
- "basic-ftp": "^5.0.5",
+ "basic-ftp": "^5.2.0",
}
--- a/package-lock.json
+++ b/package-lock.json
@@ -3516,7 +3516,7 @@
"node_modules/basic-ftp": {
- "version": "5.0.5",
- "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.0.5.tgz",
- "integrity": "sha512-<old-hash>",
+ "version": "5.2.0",
+ "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
+ "integrity": "sha512-<hash-regenerated-by-npm-install>",
"engines": {
"node": ">=10.0.0"
}
Interim mitigation if an immediate upgrade is not possible — validate server-supplied filenames before calling downloadToDir():
--- a/src/ftpDownload.js
+++ b/src/ftpDownload.js
@@
+ const safePath = path.resolve(downloadDir, remoteFile.name);
+ if (!safePath.startsWith(path.resolve(downloadDir) + path.sep)) {
+ throw new Error('Path traversal detected in filename: ' + remoteFile.name);
+ }
await client.downloadToDir(downloadDir, remoteFile);
Note: the mitigation reduces exposure for directory listings processed by your code, but only the 5.2.0 upgrade fully remediates CVE-2026-27699.For reference: rule CVE-2026-27699. Rated critical.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
package-lock.jsonaround line 3516 looked worth a second pair of eyes.CVE-2026-27699 (CRITICAL): The project depends on basic-ftp 5.0.5, which is vulnerable to a path traversal flaw (CWE-22) in the downloadToDir() method. When downloading files, a malicious or compromised FTP server can return directory listings whose filenames contain '../' traversal sequences, causing files to be written outside the intended download directory. Impact: an attacker controlling the FTP server gains arbitrary file write capability on the host — they can overwrite application source code, config files, ~/.ssh/authorized_keys, cron jobs, or startup scripts, which commonly escalates to full remote code execution. Exploitation requires no credentials or user interaction beyond the app initiating an FTP transfer to a server the attacker controls, so risk is CRITICAL. Fix: upgrade basic-ftp to >= 5.2.0, which validates that resolved download paths remain within the target directory.
Something like this might fix it:
For reference: rule
CVE-2026-27699. Rated critical.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.