CVE-2026-34841

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494CWE-506

Affected software

VendorProductVersions
usebrunobruno< 3.2.1

References

Timeline

Published
Apr 6, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-348476.1hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerCVE-2026-348485.4hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member ovCVE-2026-348494.7UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-34859.8A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of theCVE-2026-348505.9Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-348517.5Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availabilityCVE-2026-348526.5Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-348537.5Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-348547.1UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.CVE-2026-348555.7Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and cCVE-2026-348567.5UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-348575.5UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-34841: Critical severity, CVSS 9.8 | Vulnix