Threats tagged 'ghsa-5pm8-86m8-9m6r'

basic-ftp versions prior to 6.2.4 contain a vulnerability in the MLSD directory-listing parser where an unvalidated fact name "__proto__" causes a TypeError. This error is not caught by the client's retry logic and results in an unhandled promise rejection that can crash the Node.js process. The issue arises because the parser uses a plain object literal keyed by untrusted server input, allowing prototype pollution-like behavior. Any FTP server or attacker on a plaintext FTP session can trigger this denial of service by sending a crafted directory listing line.