{"action":"Upgrade @jhb.software/payload-cloudinary-plugin to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0.3.0"}],"component":"@jhb.software/payload-cloudinary-plugin","cve_ids":["CVE-2026-58200"],"ecosystem":"npm","epss":0.00314,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-h5x8-xp6m-x6q4","id":"tcs_01M5KFT8YBAJVJK8D9GFW3TJB8","modified_at":"2026-09-16T03:56:06.318054839Z","published_at":"2026-06-19T22:10:37Z","references":["https://osv.dev/vulnerability/GHSA-h5x8-xp6m-x6q4","https://github.com/jhb-software/payload-plugins/security/advisories/GHSA-h5x8-xp6m-x6q4","https://github.com/jhb-software/payload-plugins"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-h5x8-xp6m-x6q4","url":"https://osv.dev/vulnerability/GHSA-h5x8-xp6m-x6q4"}],"summary":"@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing"}