CVE-2025-12613
1 advisory.
npm/cloudinary CVE-2025-12613: high 8.6, EPSS 0.39%
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Action: Upgrade cloudinary to 2.7.0 or later.
npm i cloudinary@2.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.0 | - |
Fixed versions
| 2.7.0 |
Sources
- osv: GHSA-g4mf-96x5-5m2c
- https://nvd.nist.gov/vuln/detail/CVE-2025-12613
- https://github.com/cloudinary/cloudinary_npm/pull/709
- https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050
- https://github.com/cloudinary/cloudinary_npm
- https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740
CVE-2025-12613 · published · modified · JSON