CVE-2026-3965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3965
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3965.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3965
Aliases
Published
2026-03-11T23:32:09.955Z
Modified
2026-07-15T01:48:55.294034903Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
whyour qinglong API express.ts protection mechanism
Details

A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

Database specific 
{
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3965.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/whyour/qinglong

Affected ranges

Type
GIT
Repo
https://github.com/whyour/qinglong
Events
Introduced
33b2f2da7787219f49fca2611de6ddfae5b6ae04
Fixed
6bec52dca158481258315ba0fc2f11206df7b719
Fixed
307935c052d59ab31c128eea45d4d8bdc01c4213
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.20.0"
        },
        {
            "last_affected": "2.20.0"
        },
        {
            "introduced": "2.20.1"
        },
        {
            "last_affected": "2.20.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.20.0
2.20.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3965.json"