A vulnerability, which was classified as critical, has been found in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure.
This vulnerability is listed as CVE-2026-3965. The attack may be initiated remotely. In addition, an exploit is available.
It is advisable to upgrade the affected component.
The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
