CVE-2026-3965: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3965 is a protection mechanism failure (CWE-693) in whyour qinglong, an open-source task scheduler panel, affecting versions up to and including 2.20.1. The vulnerability exists in back/loaders/express.ts within the API Interface component, where JWT authentication can be bypassed via case manipulation of the URL path, enabling unauthenticated remote command execution through the /command-run endpoint. It was disclosed publicly on February 27, 2026, with a patch released on March 1, 2026 in version 2.20.2. The CVSS v3.1 base score is 6.3 (Medium), and the CVSS v4.0 base score is 5.3 (Medium) (VulDB, EUVD).

The root cause is a case-sensitive regular expression used for JWT (AJWT) verification in back/loaders/express.ts that fails to normalize URL paths before authentication checks (CWE-693). An attacker can bypass authentication by capitalizing one or more letters in the /api/ path prefix (e.g., sending a request to /apI/system/command-run instead of /api/system/command-run), causing the auth middleware to skip validation. Once the auth check is bypassed, the /command-run route in back/api/system.ts directly concatenates the user-supplied command parameter and passes it to promiseify(exec) without any sanitization, resulting in arbitrary OS command execution. A public PoC was disclosed on GitHub demonstrating exploitation via a simple PUT request with a JSON body containing the command field (GitHub PoC, GitHub Patch).

Successful exploitation allows a remote attacker with no prior authentication to execute arbitrary operating system commands on the server hosting the qinglong panel, effectively gaining full control of the underlying host. This can lead to confidentiality breaches (data exfiltration), integrity compromise (file modification, credential theft), and availability disruption. In observed real-world attacks, threat actors have leveraged this vulnerability to deploy cryptomining malware on developer servers, and the access gained could facilitate lateral movement into internal networks (SC World, BleepingComputer).

A public proof-of-concept exploit was disclosed on GitHub by researcher A7cc on February 27, 2026, and is actively being used in the wild (GitHub PoC). Exploitation has been reported by multiple threat intelligence sources including Snyk, BleepingComputer, and SC World, with attackers observed deploying cryptominers on vulnerable qinglong instances (Snyk Blog, BleepingComputer). The EPSS score is approximately 0.079% (low), and the vulnerability does not appear in the CISA KEV catalog as of the time of this report. The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT (EUVD).

1. Reconnaissance: Identify internet-facing qinglong panel instances (default port 5700) using tools like Shodan or Censys, targeting versions 2.20.1 and earlier.
2. Auth bypass via case manipulation: Craft an HTTP request to the /command-run endpoint using a mixed-case path such as /apI/system/command-run to bypass the case-sensitive JWT authentication regex in express.ts.
3. Send malicious PUT request: Issue a PUT request with a JSON body containing the command parameter set to the desired OS command:

PUT /apI/system/command-run HTTP/1.1
Host: <target>:5700
Content-Type: application/json

{"command":"whoami"}

4. Achieve RCE: The promiseExec method in system.ts executes the unsanitized command directly via Node.js exec(), returning output to the attacker.
5. Post-exploitation: Use the RCE to download and execute a cryptominer payload, establish persistence, or pivot to internal network resources (GitHub PoC, Snyk Blog).

• Network: Inbound PUT requests to paths matching /[aA][pP][iI]/system/command-run or mixed-case variants (e.g., /apI/system/command-run) on port 5700; outbound connections from the qinglong server to unknown external IPs, particularly for cryptomining pool connections.
• Logs: qinglong access logs showing PUT requests to /apI/ or other mixed-case API paths returning HTTP 200; Node.js process logs showing unexpected exec() calls with unusual command strings.
• Process: Unexpected child processes spawned by the qinglong Node.js process (e.g., bash, sh, curl, wget, python, or cryptominer binaries such as xmrig).
• File System: Presence of cryptominer binaries or shell scripts in writable directories accessible by the qinglong service account; new cron jobs or scheduled tasks added within the qinglong panel.
• System: Unusually high CPU utilization consistent with cryptomining activity on the host running qinglong (BleepingComputer, Snyk Blog).

The vendor released version 2.20.2 on March 1, 2026, which addresses this vulnerability via patch 6bec52dca158481258315ba0fc2f11206df7b719. The fix adds /open/user/init and /open/user/notification/init to the init guard's path list and normalizes path case before authentication checks. All users running qinglong 2.20.1 or earlier should upgrade to v2.20.2 immediately. As a temporary workaround where upgrading is not immediately possible, restrict network access to the qinglong panel (port 5700) to trusted IP addresses only using firewall rules (GitHub Release, GitHub Patch).

The vulnerability received notable coverage from security media outlets including BleepingComputer, SC World, CyberSecurityNews, and GBHackers, primarily in the context of active cryptomining campaigns exploiting qinglong flaws (BleepingComputer, SC World). Snyk published a dedicated technical blog post analyzing the RCE vulnerabilities in the qinglong task scheduler (Snyk Blog). The maintainer (whyour) was praised in the VulDB advisory for responding quickly and professionally to the responsible disclosure, releasing a patch within two days of notification. SecurityWeek also briefly noted the vulnerability in its weekly news roundup (SecurityWeek).