basic-ftp Critical Security Vulnerability: CVE-2026-27699

[tbalbacete]

The dependency proxy-agent has a sub-dependency, basic-ftp, which has a critical security vulnerability (CVE-2026-27699), which is present in even the latest release version.

[wing328]

Thanks for letting us know

The basic-ftp library contains a path traversal vulnerability in the downloadToDir() method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (../) that cause files to be written outside the intended download director

From what I understand the security vulnerability, it shouldn't affect our users of openapi-generator-cli as our CLI has nothing to do with FTP.