CVE-2025-12613

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-12613
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12613.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-12613
Aliases
Published
2025-11-10T05:15:42.900Z
Modified
2026-03-15T14:12:48.229234Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior.

Note: Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response.

References

Affected packages

Git / github.com/cloudinary/cloudinary_npm

Affected ranges

Type
GIT
Repo
https://github.com/cloudinary/cloudinary_npm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
923a66e64a6f4c0a565e6469575f641b4e62035b
Fixed
ec4b65f2b3461365c569198ed6d2cfa61cca4050
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.0"
        }
    ]
}

Affected versions

1.*
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2
1.10.0
1.11.0
1.12.0
1.13.0
1.13.1
1.13.2
1.14.0
1.15.0
1.16.0
1.17.0
1.18.0
1.18.1
1.19.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.25.2
1.26.0
1.26.1
1.26.2
1.26.3
1.27.0
1.27.1
1.28.0
1.28.1
1.29.0
1.29.1
1.3.0
1.3.1
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.36.1
1.36.2
1.36.3
1.36.4
1.37.0
1.37.1
1.37.2
1.37.3
1.38.0
1.39.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.40.0
1.41.0
1.41.1
1.5.0
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
2.*
2.0.0
2.0.0-rc
2.0.0-rc.1
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12613.json"