PT-2025-20551

CVE-2025-1087

Publicado

2025-05-09

Atualizado

2025-12-27

Descrição por

CVSS 4.0

9.3

Crítica

MétricasAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2

Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports.

Recommendations Versions prior to 11.0.2 should be updated to version 11.0.2 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Justin Steven

Marcio Almeida

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-94: Improper Control of Generation of Code (\'Code Injection\')