CVE-2026-24910

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-348

Affected software

VendorProductVersions
BunBun< 1.3.5

References

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-249118.6Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service.CVE-2026-249128.6The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-249138.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaCVE-2026-249145.5Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249157.1Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidenCVE-2026-249165.5Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service CVE-2026-249175.5UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249185.5Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249195.5Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-24927.8TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackersCVE-2026-249205.5Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249217.1Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentia
CVE-2026-24910: Medium severity, CVSS 5.9 | Vulnix