CVE-2026-34841
Critical · 9.8CVSS
9.8
EPSS
0.3%
Published
Apr 6, 2026
CISA due date
—
The record
Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @usebruno/cli | 0 | 3.2.1 |
Related vulnerabilities
- GHSA-658g-p7jg-wx5g Axios npm Supply Chain Incident Impacting @usebruno/cli Same vulnerability
- CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. CWE-494
- CVE-2026-79963 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-494
- CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-494
- CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection… CWE-494
- CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows… CWE-494
- CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote… CWE-494
- CVE-2026-82021 Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled… CWE-494