Command Injection Vulnerability in Hoverfly API Simulation Tool

CVE-2025-54123

What is CVE-2025-54123?

Hoverfly, an open source API simulation tool, is susceptible to a command injection vulnerability stemming from insufficient validation and sanitization of user inputs at the '/api/v2/hoverfly/middleware' endpoint. This vulnerability, found in versions 1.11.3 and earlier, allows an adversary to execute arbitrary system commands, potentially leading to remote code execution (RCE) on affected systems running the Hoverfly service. The flaws arise from multiple factors including inadequate input validation, unsafe command execution practices, and immediate execution during testing phases. Proper mitigation steps include disabling the set middleware API by default and updating documentation to inform users of security risks associated with exposing this endpoint.

References