by Kastro
Paper/Archive/CVE-2025-1087

CVE-2025-1087

Kong Inc. Insomnia — Arbitrary Code Execution in Kong Insomnia Desktop Application

EPSS 1%CVSS 9.3
critical.is priorityof 100
41
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 66.4.664 × 2013.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.

Affected

ProductAffectedFixed inSource
Insomnian/a – 11.0.2–CNA

Scores by source

Kong (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Kong/insomniareftantosec.com/blog/2025/06/insomnia-api-client-template-injection