Detections
Analytics
SCA: security update for @whyour/qinglong (GHSA-xj37-qjg2-xwv2)
medium Tenable Self-Hosted Container Security Plugin ID 438743
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown
function of the file back/loaders/express.ts of the component API Interface. The manipulation of the
argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit
has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue.
The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the
affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and
highly professional. (CVE-2026-3965)
Solution
Update the @whyour/qinglong library and its related packages to version 2.20.2 or later.See Also
Plugin Details
Severity: Medium
ID: 438743
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 3/12/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
Percentile: 96.61
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2026-3965
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/12/2026
Vulnerability Publication Date: 3/11/2026
Reference Information
CVE: CVE-2026-3965
cwe: CWE-693