CVE-2026-34841 json
Axios npm Supply Chain Incident Impacting @usebruno/cli
published 7mo ago modified 17d ago also EUVD-2026-19354 , GHSA-658g-p7jg-wx5g
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1
Patch / fix
- npm @usebruno/cli 3.2.1
- usebruno bruno 3.2.1
Is CVE-2026-34841 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @usebruno/cli | <3.2.1 |
3.2.1 |
Affected products
- usebruno bruno
Classification
References
-
github.com
/usebruno/bruno/pull/7632
web, issue-tracking, patch
-
github.com
/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g
web, mitigation, patch, vendor-advisory
-
github.com
/axios/axios/issues/10604
web, issue-tracking
-
aikido.dev
/blog/axios-npm-compromised-maintainer-hijacked-rat
web, mitigation, press/media-coverage
-
nvd.nist.gov
/vuln/detail/CVE-2026-34841
advisory
-
github.com
/advisories/GHSA-fw8c-xr5c-95f9
advisory
-
github.com
/usebruno/bruno
package
Sources
- CVE List CVE-2026-34841
- GitHub Advisory GHSA-658g-p7jg-wx5g
- NVD CVE-2026-34841
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.