PT-2025-45601 · Cloudinary · Cloudinary

Patryk Konior · Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-12613

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions cloudinary versions prior to 2.7.0

Description The package is susceptible to Arbitrary Argument Injection because of improper parsing of parameter values that include an ampersand (&). This allows an attacker to inject additional, unintended parameters. This could lead to malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior.

Recommendations Update to version 2.7.0 or later.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2025-12613

GHSA-G4MF-96X5-5M2C

Affected Products

Cloudinary

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-12613 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4mf-96x5-5m2c · Vendor Advisory
• https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050 · Note
• https://github.com/cloudinary/cloudinary_npm/pull/709 · Note
• https://github.com/cloudinary/cloudinary_npm · Note
• https://twitter.com/CVEnew/status/1987756328542929120 · Twitter Post
• https://twitter.com/cracbot/status/1989287251369656469 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740 · Note
• https://twitter.com/VulmonFeeds/status/1987786615079522681 · Twitter Post
• https://twitter.com/CveFindCom/status/1987757662574911907 · Twitter Post
• https://twitter.com/CveTodo/status/1987754145923682400 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ow3bmx/resumen_diario_de_vulnerabilidades_13112025 · Reddit Post
• https://t.me/CVEtracker/36895 · Telegram Post
• https://t.me/cveNotify/142244 · Telegram Post