CVE-2026-42994 is an OS Command Injection vulnerability in Bitwarden CLI version 2026.4.0, introduced via a supply chain compromise when the package was obtained from npm. The embedded malicious code allows an attacker to execute arbitrary OS commands due to improper neutralization of special elements in command inputs. The vulnerability has a high CVSS 4.0 score of 8.8, reflecting its potential impact and ease of exploitation without privileges or user interaction. The affected version is specifically 2026.4.0 released on April 22, 2026. No patch or official remediation level has been published as of now, and no exploits have been reported in the wild.

The vulnerability enables remote attackers to execute arbitrary OS commands on systems running the affected Bitwarden CLI version without requiring privileges or user interaction. This can lead to significant integrity and confidentiality impacts. The supply chain compromise means users who installed the affected version from npm may have inadvertently introduced malicious code into their environments. However, no active exploitation has been observed to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using Bitwarden CLI version 2026.4.0 obtained from npm and verify the integrity of their installations. Monitoring vendor communications for updates and applying any official patches promptly is recommended.