CVE-2026-34841 Axios npm Supply Chain Incident Impacting @usebruno/cli
Compromised axios dependency in Bruno CLI allowed attackers to deploy a Remote Access Trojan on developer machines during a specific time window.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34841?
CVE-2026-34841 is a critical vulnerability in usebruno bruno, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and ~03:30 UTC on March 31, 2026 may have been impacted. Upgrade to 3.2.1
Which versions are affected by CVE-2026-34841?
2 open source packages ship an affected version, including @usebruno/cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@usebruno/cli npm | All versions | 3.2.1 |
@usebruno/cli npm | All versions | 3.2.1 |
Products include Usebruno Bruno.
How do I fix CVE-2026-34841?
Upgrade @usebruno/cli to 3.2.1 or later.
Is CVE-2026-34841 being exploited?
There is no known exploitation of CVE-2026-34841 in the wild and no public exploit code.
Other vulnerabilities in usebruno bruno
Sources
Also known as GHSA-658g-p7jg-wx5g.