npm cloudinary vulnerabilities

Latest npm cloudinary CVEs

Newest publication first

1. CVE-2025-12613 Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand

   Published 2025-11-10

   High·CVSS 8.8 EPSS 0.39%

   Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.