PT-2025-20551 · Kong · Kong Insomnia Desktop Application

Justin Steven + 1 · Published 2025-05-09 · Updated 2025-12-27 · CVE-2025-1087

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2

Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports.

Recommendations Versions prior to 11.0.2 should be updated to version 11.0.2 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2025-1087

Affected Products

Kong Insomnia Desktop Application

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-1087 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1087 · Vendor Advisory
• https://github.com/Kong/insomnia · Note
• https://t.me/cvedetector/24948 · Telegram Post
• https://reddit.com/r/secops_solution/comments/1kwst3h/top_ubuntu_security_patches_you_shouldnt_ignore · Reddit Post
• https://twitter.com/ksg93rd/status/1936150267398922376 · Twitter Post
• https://twitter.com/syedaquib77/status/1922375138743615776 · Twitter Post
• https://tantosec.com/blog/2025/06/insomnia-api-client-template-injection · Note
• https://twitter.com/cybercronai/status/1920847577093722340 · Twitter Post
• https://twitter.com/dailytechonx/status/1936167177843097969 · Twitter Post
• https://twitter.com/BSidesCbr/status/1944532294980485487 · Twitter Post
• https://twitter.com/threatsbank/status/1922336437715767725 · Twitter Post
• https://t.me/pentestingnews/61195 · Telegram Post
• https://twitter.com/threatsbank/status/1937896569128321126 · Twitter Post
• https://t.me/cybersecuritytechnologies/12076 · Telegram Post