Back to Database
Status published
Critical
CVE-2025-1087
Arbitrary Code Execution in Kong Insomnia Desktop Application
Vulnerability Description
Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1087
Credits & Attribution
No credits recorded in the NVD database.
References
Affected Vendor
Kong Inc.
View all reports →Affected Software
Insomnia
Vulnerable Versions:
Unknown
Timeline
Official Publish:
May 9th, 2025
Last Modified:
September 17th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1059
Command and Scripting Interpreter
Execution
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1213
Data from Information Repositories
Collection
T1565.002
Stored Data Manipulation
Impact
T1505.003
Web Shell
Persistence
T1105
Ingress Tool Transfer
Command and Control