{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/SpectoLabs/hoverfly","cve_ids":["CVE-2025-54123"],"ecosystem":"Go","epss":0.10908,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-r4h8-hfp2-ggmf","id":"tcs_01M5KGA9AY867D3RG40Q71RH4J","modified_at":"2026-03-03T04:56:54.102772Z","published_at":"2025-09-17T17:03:49Z","references":["https://osv.dev/vulnerability/GO-2025-3944","https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf","https://nvd.nist.gov/vuln/detail/CVE-2025-54123","https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40","https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e","https://github.com/SpectoLabs/hoverfly/pull/1203","https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173","https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13","https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GO-2025-3944","url":"https://osv.dev/vulnerability/GO-2025-3944"},{"source":"nvd","source_id":"CVE-2025-54123","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54123"}],"summary":"Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly"}