Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
qs package may allow code execution
published 3 months ago
Summary
The qs library (versions before 3.1.0‑tuxcare.2) contains a security weakness that could let an attacker run unwanted code on your system. This could affect any application that uses the qs package, such as those built with the ljharb/qs code. Update to version 3.1.0‑tuxcare.2 or later to remove the risk.
What to do
- Update ljharb qs to version 3.1.0-tuxcare.2.
- Update qs to version 3.1.0-tuxcare.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | ljharb | qs |
< 3.1.0-tuxcare.2 Fix: upgrade to 3.1.0-tuxcare.2
|
| TuxCare:npm | – | qs |
< 3.1.0-tuxcare.2 Fix: upgrade to 3.1.0-tuxcare.2
|
Original advisory text
TuxCare security update for qs (1 CVE)
TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.2.
Timeline
Published4 Aug 2026
Updated15 Sep 2026
First seen3 Sep 2026
Sources
CLSA-2026-1784596314 · OSV
Track software like this
Free during beta