PT-2025-20551 · Kong · Kong Insomnia Desktop Application

Justin Steven + 1 · Publicado 2025-05-09 · Atualizado 2025-12-27 · CVE-2025-1087

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2

Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports.

Recommendations Versions prior to 11.0.2 should be updated to version 11.0.2 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-20

Identificadores relacionados

CVE-2025-1087

Produtos afetados

Kong Insomnia Desktop Application

Referências · 20

• https://github.com/Kong/insomnia · Nota
• https://t.me/cvedetector/24948 · Publicação no Telegram
• https://reddit.com/r/secops_solution/comments/1kwst3h/top_ubuntu_security_patches_you_shouldnt_ignore · Publicação no Reddit
• https://twitter.com/ksg93rd/status/1936150267398922376 · Publicação no Twitter
• https://twitter.com/syedaquib77/status/1922375138743615776 · Publicação no Twitter
• https://tantosec.com/blog/2025/06/insomnia-api-client-template-injection · Nota
• https://twitter.com/cybercronai/status/1920847577093722340 · Publicação no Twitter
• https://twitter.com/dailytechonx/status/1936167177843097969 · Publicação no Twitter
• https://twitter.com/BSidesCbr/status/1944532294980485487 · Publicação no Twitter
• https://twitter.com/threatsbank/status/1922336437715767725 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-1087 · Nota de Segurança
• https://t.me/pentestingnews/61195 · Publicação no Telegram
• https://twitter.com/threatsbank/status/1937896569128321126 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/12076 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-1087 · Aviso do Fabricante