CVE-2025-12613: Cloudinary Api Sign Request Argument Injection
Cloudinary SDKs before 2.7.0 are vulnerable to Arbitrary Argument Injection in the `api_sign_request` function. The function concatenates parameter keys and values without properly escaping ampersands (`&`), allowing attackers to inject additional parameters (e.g. `&overwrite=true`) if parameter values are user-controlled. Use the built-in `verify_api_respon
JSgreprules fetch cve-2025-12613-cloudinary-api-sign-request-argument-injection --engine opengrepDescription
Cloudinary SDKs before 2.7.0 are vulnerable to Arbitrary Argument Injection in the `api_sign_request` function. The function concatenates parameter keys and values without properly escaping ampersands (`&`), allowing attackers to inject additional parameters (e.g. `&overwrite=true`) if parameter values are user-controlled. Use the built-in `verify_api_respon
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.