---
title: "CVE-2025-54123: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation"
url: https://erroneo.us/security/cve/CVE-2025-54123/
description: "CVE-2025-54123 (github.com/SpectoLabs/hoverfly (Go)): Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-09-10
date_modified: 2025-09-13
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-54123"
kev: false
cvss: 9.8
epss: 0.10543
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-54123: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 10.5% , percentile 96: FIRST’s model estimates a 10.5% chance of exploitation activity in the next 30 days, higher than 96% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes github.com/SpectoLabs/hoverfly (Go) <= 1.11.3, no fixed version listed . Check your lockfile, including transitive dependencies.

## What it is

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in localmiddleware.go line 14-19; and Immediate Execution During Testing in hoverflyservice.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

## Affected packages

- Go `github.com/SpectoLabs/hoverfly` <= 1.11.3 → fixed: none listed

## Affected products (CVE record)

- SpectoLabs hoverfly: <= 1.11.3

## Severity

- GitHub_M CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 10.54% probability of exploitation activity in the next 30 days; percentile 96.

## Sources

- [GitHub Advisory GHSA-r4h8-hfp2-ggmf](https://github.com/advisories/GHSA-r4h8-hfp2-ggmf)
- [CVE.org record CVE-2025-54123](https://www.cve.org/CVERecord?id=CVE-2025-54123)
- [NVD entry CVE-2025-54123](https://nvd.nist.gov/vuln/detail/CVE-2025-54123)
- [github.com](https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf)
- [github.com](https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40)
- [github.com](https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e)
- [github.com](https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173)
- [github.com](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13)
- [github.com](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93)
- [github.com](https://github.com/SpectoLabs/hoverfly/pull/1203)

---
Source page: https://erroneo.us/security/cve/CVE-2025-54123/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt