PT-2025-14117 · Bruno · Bruno

Published 2025-04-01 · Updated 2025-04-05 · CVE-2025-30354

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Bruno versions prior to 1.39.1

Description A bug in the assertion runtime of Bruno, an open source IDE for exploring and testing APIs, caused assert expressions to run in Developer Mode even when Safe Mode was selected. This resulted in the sandbox settings being ignored when a single request was run. The attack surface is limited to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user, specifically downloading and opening an externally provided malicious Bruno collection.

Recommendations For versions prior to 1.39.1, update to version 1.39.1 to fix the issue. As a temporary workaround, consider avoiding the import of collections from untrusted or malicious sources until the update is applied. Restrict access to externally provided Bruno collections to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2025-30354

GHSA-HFFG-7V8V-79J3

Affected Products

Bruno

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30354.json · Exploit
• https://github.com/usebruno/bruno/security/advisories/GHSA-hffg-7v8v-79j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30354 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1907078468866568415 · Twitter Post
• https://twitter.com/CVEnew/status/1908663690662220204 · Twitter Post