GHSA-g4mf-96x5-5m2c
High · 8.6CVSS
8.6
EPSS
—
Published
Nov 10, 2025
CISA due date
—
The record
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | cloudinary | 0 | 2.7.0 |
Related vulnerabilities
- CVE-2025-12613 Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument… Same vulnerability
- CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
- CVE-2026-112900 Pillow is a Python imaging library. CWE-88
- CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
- CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
- CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
- CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88
- CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables… CWE-88