CVE-2026-34841

Katalog CVE

CVSS 9.8 · Critical EPSS 0,32%

Kerentanan Download of Code Without Integrity Check pada usebruno bruno. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1

Rincian

Terbit di NVD

6 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check
CWE-506: Embedded Malicious Code

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g mitigasi · patch · advisory vendor
• https://github.com/usebruno/bruno/pull/7632 issue tracking · patch
• https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat mitigasi · press/media coverage
• https://github.com/axios/axios/issues/10604 issue tracking