CVE-2026-34841 - Vulnerability Analysis

Overview

Bruno < 3.2.1 contains a supply chain attack caused by compromised axios npm package dependency, letting attackers deploy a cross-platform Remote Access Trojan, exploit requires users to run npm install during the attack window.

Severity & Score

Impact

Attackers can deploy a remote access trojan, leading to full system compromise and unauthorized remote control.

Mitigation

Upgrade to version 3.2.1 or later.

References

• https://github.com/axios/axios/issues/10604
• https://github.com/usebruno/bruno/pull/7632
• https://github.com/usebruno/bruno/security/advisories/GHSA-658g-p7jg-wx5g
• https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner