Vulnerability · Published Nov 10, 2025 · Assigned by snyk
CVE-2025-12613
High 8.6
In plain English
A high-severity argument injection in cloudinary. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior. **Note:** Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | cloudinary | 2.7.0 | GHSA-g4mf-96x5-5m2c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | cloudinary | 0 – before 2.7.0 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L