CVE-2025-1087

Summary

Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper Input Validation
• CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• https://tantosec.com/blog/2025/06/insomnia-api-client-template-injection/

References

• https://github.com/Kong/insomnia

• ←Previous
• Next→