{
  "@id": "urn:uuid:ec7b3e6f-d7a8-4586-9b5d-7a6d4041485c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T21:29:00.039512+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-10-01T14:50:16.510209+00:00",
      "status_notes": "Vulnerability CVE-2026-102990 affects version 6.0.0 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-102990"
      },
      "action_statement": "Vulnerability CVE-2026-102990 affects version 6.0.0 of basic-ftp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-12T21:59:17.322996+00:00",
      "status_notes": "Vulnerability CVE-2026-126345 affects version 6.0.0 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-126345"
      },
      "action_statement": "Vulnerability CVE-2026-126345 affects version 6.0.0 of basic-ftp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-12T22:50:34.840878+00:00",
      "status_notes": "Vulnerability CVE-2026-126346 affects version 6.0.0 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-126346"
      },
      "action_statement": "Vulnerability CVE-2026-126346 affects version 6.0.0 of basic-ftp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-10-30T06:32:00.079238+00:00",
      "status_notes": "Vulnerability CVE-2026-27699 affects version 6.0.0 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-27699"
      },
      "action_statement": "Vulnerability CVE-2026-27699 affects version 6.0.0 of basic-ftp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability CVE-2026-39983 does not affect version 6.0.0 of basic-ftp. not_affected \u2014 Target basic-ftp 6.0.0 already contains the upstream fix. FtpContext.send() rejects any command containing CR, LF or NUL before writing to the control socket, so CRLF in path arguments can no longer split commands. The fix shipped in the upstream release (commits 2ecc8e2 and 20327d3 by the upstream maintainer); no TuxCare commits exist in the history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39983"
      },
      "impact_statement": "not_affected \u2014 Target basic-ftp 6.0.0 already contains the upstream fix. FtpContext.send() rejects any command containing CR, LF or NUL before writing to the control socket, so CRLF in path arguments can no longer split commands. The fix shipped in the upstream release (commits 2ecc8e2 and 20327d3 by the upstream maintainer); no TuxCare commits exist in the history."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability CVE-2026-41324 does not affect version 6.0.0 of basic-ftp. not_affected \u2014 The target (basic-ftp 6.0.0) already contains the upstream fix for CVE-2026-41324. StringWriter enforces a maximum byte length, Client.list() passes options.maxListingBytes (default 40 MiB) to it, and the transfer errors out when the cap is exceeded. The fix commits are upstream-authored (patrickjuchli@gmail.com) and ship in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41324"
      },
      "impact_statement": "not_affected \u2014 The target (basic-ftp 6.0.0) already contains the upstream fix for CVE-2026-41324. StringWriter enforces a maximum byte length, Client.list() passes options.maxListingBytes (default 40 MiB) to it, and the transfer errors out when the cap is exceeded. The fix commits are upstream-authored (patrickjuchli@gmail.com) and ship in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:28:00.045761+00:00",
      "status_notes": "Vulnerability CVE-2026-44240 does not affect version 6.0.0 of basic-ftp. not_affected \u2014 The target already contains the upstream fix, commit 980371b \"Guard against unbounded control response\" by Patrick Juchli. FtpContext._onControlSocketData caps accumulated control-channel data at 64 KiB and closes the connection with an error when the cap is exceeded. The fix shipped in the upstream release the target is based on, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44240"
      },
      "impact_statement": "not_affected \u2014 The target already contains the upstream fix, commit 980371b \"Guard against unbounded control response\" by Patrick Juchli. FtpContext._onControlSocketData caps accumulated control-channel data at 64 KiB and closes the connection with an error when the cap is exceeded. The fix shipped in the upstream release the target is based on, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.0",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability GHSA-6v7q-wjvx-w8wg does not affect version 6.0.0 of basic-ftp. not_affected \u2014 The upstream fix (commit 20327d3, \"Move prevention of control character injection to more central place\") is already in the target. FtpContext.send() now rejects any command containing CR, LF or NUL. login() and _openDir() both send through it, so neither vector can inject extra commands. The fix shipped in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6v7q-wjvx-w8wg"
      },
      "impact_statement": "not_affected \u2014 The upstream fix (commit 20327d3, \"Move prevention of control character injection to more central place\") is already in the target. FtpContext.send() now rejects any command containing CR, LF or NUL. login() and _openDir() both send through it, so neither vector can inject extra commands. The fix shipped in the upstream release, so the verdict is not_affected."
    }
  ]
}