CVE-2026-34841 - Vulnerability Analysis

Overview

Bruno < 3.2.1 contains a supply chain attack caused by compromised axios npm package dependency, letting attackers deploy a cross-platform Remote Access Trojan, exploit requires users to run npm install during the attack window.

Severity & Score

Impact

Attackers can deploy a remote access trojan, leading to full system compromise and unauthorized remote control.

Mitigation

Upgrade to version 3.2.1 or later.

References

• https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g
• https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
• https://github.com/axios/axios/issues/10604
• https://github.com/usebruno/bruno/pull/7632

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 6, 2026

🔴 CVE-2026-34841 - Critical (9.8) Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34841/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner