CVE-2026-34841 usebruno CVE debrief

Who should care

Users of the Bruno IDE, particularly those who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026, should assess their exposure and upgrade to version 3.2.1 to mitigate the vulnerability.

Why it matters

CVE-2026-34841 involves a critical supply chain attack on the Bruno IDE through a compromised axios npm package. Users who ran npm install during a specific time frame may have been impacted. Immediate upgrade to version 3.2.1 is recommended to mitigate the vulnerability.

• Potential deployment of a Remote Access Trojan
• Compromised axios npm package in the supply chain
• Critical severity with a CVSS score of 9.8
• Need for immediate upgrade to version 3.2.1

Technical summary

CVE-2026-34841 involves a supply chain attack on the Bruno IDE through a compromised axios npm package, introducing a Remote Access Trojan. Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026, may have been impacted. The CVE has a CVSS score of 9.8, indicating critical severity. The attack vector involves a hidden dependency deploying a cross-platform RAT. Immediate upgrade to version 3.2.1 is recommended to mitigate the vulnerability. Affected users should review their npm install logs and monitor their environment for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 3.2.1 of the Bruno IDE
• Review npm install logs for potential compromise between 00:21 UTC and ~03:30 UTC on March 31, 2026
• Monitor for suspicious activity in your environment
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

CVE-2026-34841 involves a supply chain attack on the Bruno IDE through a compromised axios npm package, introducing a Remote Access Trojan. Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026, may have been impacted. The CVE has a CVSS score of 9.8, indicating critical severity. Evidence is limited to CVE and NVD records, which provide details on the supply chain attack and affected versions. Defenders should verify potential exposure through npm install logs and review system activity for the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.