CVE-2026-34841: CWE-494: Download of Code Without Integrity Check in usebruno bruno
Bruno, an open source IDE for API testing, was affected by a supply chain attack prior to version 3. 2. 1. The attack involved compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and approximately 03:30 UTC on March 31, 2026, may have been impacted. The vulnerability is addressed by upgrading to version 3. 2. 1.
AI Analysis
Technical Summary
CVE-2026-34841 is a critical supply chain vulnerability in the Bruno IDE affecting versions prior to 3.2.1. The issue stems from a compromised axios npm package version that introduced a hidden dependency containing a Remote Access Trojan (RAT). This vulnerability is categorized under CWE-494 (Download of Code Without Integrity Check) and CWE-506 (Embedded Malicious Code). The attack window was limited to a few hours on March 31, 2026, during which users running npm install could have unknowingly installed malicious code. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Exploitation of this vulnerability could result in remote code execution via the installed RAT, leading to full system compromise including loss of confidentiality, integrity, and availability. The supply chain nature means users installing affected package versions during the specified time window were at risk of infection. There are no known exploits in the wild reported yet.
Mitigation Recommendations
Users should upgrade Bruno to version 3.2.1 or later to remediate this vulnerability. Since the attack was time-limited and involved a specific compromised package version, users who installed the affected versions during the incident window should audit their systems for potential compromise. Patch status is not explicitly confirmed in the advisory, but the upgrade to 3.2.1 is indicated as the fix. No cloud service remediation applies as Bruno is not a cloud service.
CVE-2026-34841: CWE-494: Download of Code Without Integrity Check in usebruno bruno
Description
Bruno, an open source IDE for API testing, was affected by a supply chain attack prior to version 3. 2. 1. The attack involved compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and approximately 03:30 UTC on March 31, 2026, may have been impacted. The vulnerability is addressed by upgrading to version 3. 2. 1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34841 is a critical supply chain vulnerability in the Bruno IDE affecting versions prior to 3.2.1. The issue stems from a compromised axios npm package version that introduced a hidden dependency containing a Remote Access Trojan (RAT). This vulnerability is categorized under CWE-494 (Download of Code Without Integrity Check) and CWE-506 (Embedded Malicious Code). The attack window was limited to a few hours on March 31, 2026, during which users running npm install could have unknowingly installed malicious code. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Exploitation of this vulnerability could result in remote code execution via the installed RAT, leading to full system compromise including loss of confidentiality, integrity, and availability. The supply chain nature means users installing affected package versions during the specified time window were at risk of infection. There are no known exploits in the wild reported yet.
Mitigation Recommendations
Users should upgrade Bruno to version 3.2.1 or later to remediate this vulnerability. Since the attack was time-limited and involved a specific compromised package version, users who installed the affected versions during the incident window should audit their systems for potential compromise. Patch status is not explicitly confirmed in the advisory, but the upgrade to 3.2.1 is indicated as the fix. No cloud service remediation applies as Bruno is not a cloud service.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T20:52:53.285Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d3dfa80a160ebd92c701d2
Added to database: 4/6/2026, 4:30:32 PM
Last enriched: 4/14/2026, 3:52:38 PM
Last updated: 5/21/2026, 11:34:13 PM
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.