What is CVE-2026-34841?

CVE-2026-34841 is a critical-severity vulnerability in Usebruno Bruno, classified under Download of Code Without Integrity Check. CVSS score: 9.8/10. Published 2026-04-06.

How severe is CVE-2026-34841?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Usebruno Bruno

CVE-2026-34841

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1

Published 2026-04-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (22.6th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 22.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Usebruno Bruno — versions < 3.2.1

Weakness classification (CWE)

References

github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g (Patch, Mitigation, Vendor Advisory)
github.com/axios/axios/issues/10604 (Issue Tracking)
github.com/usebruno/bruno/pull/7632 (Patch, Issue Tracking)
www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat (Mitigation, Press/Media Coverage)

Frequently asked questions

What is CVE-2026-34841?: CVE-2026-34841 is a critical-severity vulnerability in Usebruno Bruno, classified under Download of Code Without Integrity Check. CVSS score: 9.8/10. Published 2026-04-06.
How severe is CVE-2026-34841?: Critical severity. CVSS v3 base score is 9.8 out of 10.