Back to KEVs

CVE-2026-3965

whyour qinglong API express.ts protection mechanism

Basic Information

CVE State
PUBLISHED
Reserved Date
March 11, 2026
Published Date
March 11, 2026
Last Updated
March 12, 2026
Vendor
whyour
Product
qinglong
Description
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

CVSS Scores

CVSS v4.0

5.3 - MEDIUM

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS v3.1

6.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CVSS v3.0

6.3 - MEDIUM

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CVSS v2.0

6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

SSVC Information

Exploitation
poc
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2026-04-10 00:00:00 UTC) Source

References

https://vuldb.com/?id.350394 https://vuldb.com/?ctiid.350394 https://vuldb.com/?submit.768861 https://github.com/A7cc/cve/issues/6 https://github.com/whyour/qinglong/pull/2941 https://github.com/A7cc/cve/issues/6#issue-3999235307 https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719 https://github.com/whyour/qinglong/releases/tag/v2.20.2 https://github.com/whyour/qinglong/

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-04-10 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel