Executive brief
@whyour/qinglong is a task scheduling and automation system for managing background jobs. A vulnerability in its API protection mechanism allows unauthenticated attackers to bypass authentication using case manipulation and execute arbitrary commands on the server, potentially leading to complete system compromise and lateral movement within internal networks.
Technical details
The vulnerability is an authentication bypass combined with remote command execution in the qinglong system. The root cause is a case-sensitive regex filter in the express.ts API route that can be bypassed by capitalizing the API prefix (e.g., "/apI/" instead of "/api/"), allowing access to protected endpoints without a valid JWT token. Once authenticated protection is bypassed, the /command-run endpoint in system.ts accepts user-supplied command parameters that are directly passed to the promiseExec method without sanitization, enabling arbitrary shell command execution. Attack requires network access but no authentication or user interaction. The fix was released in version 2.20.2 (commit 6bec52dca158481258315ba0fc2f11206df7b719).
Affected products
- @whyour qinglong up to 2.20.1
Timeline
- 2026-02-27: disclosed: Vulnerability disclosed on GitHub issue
- 2026-03-12: advisory: GHSA-xj37-qjg2-xwv2 and CVE-2026-3965 published
- 2026-03-12: patched: Version 2.20.2 released with fix