A severe security vulnerability, tracked as CVE-2025-1087, has been discovered in the widely-used Insomnia API Client developed by Kong. This vulnerability allows attackers to execute arbitrary code through malicious template injection, posing significant risks to developers and security professionals. Despite multiple attempted patches, the vulnerability remains exploitable in the latest version 11.2.0. The issue highlights the importance of securing development and testing environments, as it effectively turns a trusted security tool into a potential attack vector.