{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.11.3"}],"component":"github.com/SpectoLabs/hoverfly","cve_ids":["CVE-2025-54123"],"ecosystem":"Go","epss":0.10908,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-r4h8-hfp2-ggmf","id":"tcs_01M5KFM1YRA4JDVQMC5QG1BYKF","modified_at":"2025-09-17T17:42:06.792469Z","published_at":"2025-09-10T19:48:43Z","references":["https://osv.dev/vulnerability/GHSA-r4h8-hfp2-ggmf","https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf","https://nvd.nist.gov/vuln/detail/CVE-2025-54123","https://github.com/SpectoLabs/hoverfly/pull/1203","https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40","https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e","https://github.com/SpectoLabs/hoverfly","https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173","https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13","https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r4h8-hfp2-ggmf","url":"https://osv.dev/vulnerability/GHSA-r4h8-hfp2-ggmf"}],"summary":"Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation"}