Vulnerability · Published May 9, 2025 · Assigned by Kong

CVE-2025-1087Arbitrary Code Execution in Kong Insomnia Desktop Application

Critical 9.3

In plain English

A critical-severity improper input validation in Insomnia from Kong Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)1.1%top 33.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.

Affected products (as reported)

Vendor	Product	Versions
Kong Inc.	Insomnia	n/a – through 11.0.2

Weakness: CWE-20, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

In plain English

Official description

Affected products (as reported)

References