CVE-2025-1087: Kong Inc Insomnia

Critical severity, CVSS 9.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.

Affected products

• Kong Inc Insomnia: up to and including 11.0.2

Published 2025-05-09. Last modified 2026-06-17.