Executive brief
Cloudinary's Node.js SDK contains a vulnerability in parameter parsing that allows attackers to inject additional, unintended parameters into API requests by embedding ampersands in parameter values. This can enable attackers to bypass security checks, alter data, or manipulate application behavior without authentication. Organizations using affected versions of the SDK for file uploads, image processing, or API interactions should upgrade immediately.
Technical details
The vulnerability is an Arbitrary Argument Injection (CWE-88) caused by improper parsing of parameter values containing ampersand characters. When parameters are constructed, an ampersand within a parameter value is incorrectly interpreted as a delimiter, allowing an attacker to inject additional unintended parameters into the API call. The attack is network-accessible and requires no authentication or user interaction. An attacker can inject parameters to bypass security controls, manipulate API behavior, or alter application data. The vulnerability affects all versions before 2.7.0, which includes the fix for this parameter injection vulnerability.
Affected products
- Cloudinary Node SDK before 2.7.0
Timeline
- 2025-11-10: disclosed
- 2025-06-18: patched: Fix merged in PR #709