@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @whyour/qinglong | < 2.20.2 | 2.20.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-3965
- https://github.com/A7cc/cve/issues/6
- https://github.com/A7cc/cve/issues/6#issue-3999235307
- https://github.com/whyour/qinglong/pull/2941
- https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719
- https://github.com/whyour/qinglong
- https://github.com/whyour/qinglong/releases/tag/v2.20.2
- https://vuldb.com/?ctiid.350394
- https://vuldb.com/?id.350394
- https://vuldb.com/?submit.768861
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-693- Platform
- npm
- Package
@whyour/qinglong- Disclosed
- 12.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-xj37-qjg2-xwv2 - CC BY 4.0
Vulnerability history: @whyour/qinglong
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 03.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Low 1
Disclosures per year
- 2026: 2
-
@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.