usebruno CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL usebruno CVE published 2026-04-06

CVE-2026-34841

CVE-2026-34841 involves a supply chain attack on the Bruno IDE through a compromised axios npm package, introducing a Remote Access Trojan. Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026, may have been impacted. The CVE has a CVSS score of 9.8, indicating critical severity. Users should upgrade to version 3.2.1 to mitigate the vulnerability.