Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-12613 · Microsoft / collected KEV context

EUVD-2025-44030

GHSA-g4mf-96x5-5m2c

cve-program · CVE-2025-12613

• https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740
• https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050
• https://github.com/cloudinary/cloudinary_npm/pull/709

euvd · EUVD-2025-44030

• https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740
• https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050
• https://github.com/cloudinary/cloudinary_npm/pull/709

nvd · CVE-2025-12613

• https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050
• https://github.com/cloudinary/cloudinary_npm/pull/709
• https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740

osv · GHSA-g4mf-96x5-5m2c

• https://nvd.nist.gov/vuln/detail/CVE-2025-12613
• https://github.com/cloudinary/cloudinary_npm/pull/709
• https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050
• https://github.com/cloudinary/cloudinary_npm
• https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740

No related operational record is retained in the current change model.