PT-2026-29967 · Unknown+1 · @Usebruno/Cli+1

Ashishkurmi · Published 2026-04-02 · Updated 2026-04-06 · CVE-2026-34841

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @usebruno/cli versions installed between 00:21 UTC and ~03:30 UTC on March 31, 2026

Description A supply chain attack involving compromised versions of the axios npm package introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install during the affected time window may have been impacted, potentially leading to the execution of a malicious postinstall script, RAT installation, and exfiltration of credentials and sensitive data. Bruno desktop app users and those who installed outside the attack window were not impacted. The compromised axios versions (1.14.1, 0.30.4) have been removed from npm.

Recommendations If you installed @usebruno/cli during the affected window, reinstall dependencies. Rotate all credentials and secrets.

Fix

RCE

Weakness Enumeration

CWE-494

CWE-506

CWE-1395

Related Identifiers

CVE-2026-34841

GHSA-658G-P7JG-WX5G

Affected Products

@Usebruno/Cli

Axios

References · 12

• https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g · Vendor Advisory
• https://github.com/usebruno/bruno/pull/7632 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34841 · Security Note
• https://osv.dev/vulnerability/GHSA-658g-p7jg-wx5g · Vendor Advisory
• https://github.com/axios/axios/issues/10604 · Note
• https://github.com/usebruno/bruno · Note
• https://twitter.com/CVEnew/status/2041223982725108170 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041194138704498935 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040078109668429926 · Twitter Post
• https://github.com/advisories/GHSA-fw8c-xr5c-95f9 · Note
• https://twitter.com/CveFindCom/status/2041210007543308550 · Twitter Post
• https://aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat · Note