Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior.
Note: Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | cloudinary | < 2.7.0 | 2.7.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L- Weakness (CWE)
CWE-88- Platform
- npm
- Package
cloudinary- Disclosed
- 10.11.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g4mf-96x5-5m2c - CC BY 4.0
Vulnerability history: cloudinary
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.