CVE-2025-54123: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 10.5%, percentile 96: FIRST’s model estimates a 10.5% chance of exploitation activity in the next 30 days, higher than 96% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes github.com/SpectoLabs/hoverfly (Go) <= 1.11.3, no fixed version listed. Check your lockfile, including transitive dependencies.

What it is

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in localmiddleware.go line 14-19; and Immediate Execution During Testing in hoverflyservice.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

From the GitHub advisory

Summary It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection through its /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input.

Details The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware.

This issue is born due to combination of three code level flaws:

1. Insufficient Input Validation in middleware.go line 94-96:

2. Unsafe Command Execution in localmiddleware.go line 14-19:

Weakness type: CWE-20, CWE-78.

Product: github.com/SpectoLabs/hoverfly (Go) · Assigned by: GitHub_M · Published: 2025-09-10

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 10.54% probability of exploitation activity in the next 30 days; percentile 96.

Timeline

• 2025-09-10 — CVE record last updated
• 2025-09-10 — CVE record published by GitHub_M
• 2025-09-10 — GitHub-reviewed advisory GHSA-r4h8-hfp2-ggmf published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-r4h8-hfp2-ggmf github.com
2. CVE.org record CVE-2025-54123 cve.org
3. NVD entry CVE-2025-54123 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. github.com github.com
7. github.com github.com

Critical Go advisories · Today’s Security Digest