Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/cli

Critical 9.8

In plain English

A critical-severity security flaw in bruno from usebruno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@usebruno/cli	3.2.1	GHSA-658g-p7jg-wx5g

Affected products (as reported)

Vendor	Product	Versions
usebruno	bruno	< 3.2.1

Weakness: CWE-494, CWE-506 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g x_refsource_CONFIRM
https://github.com/axios/axios/issues/10604 x_refsource_MISC
https://github.com/usebruno/bruno/pull/7632 x_refsource_MISC
https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat x_refsource_MISC