CVE-2026-34841 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-34841 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2026-34841) has been identified in the npm package @usebruno/cli due to a supply chain attack involving compromised versions of the axios package. The attack may have affected users who installed the CLI between 00:21 UTC and ~03:30 UTC on March 31, 2026, leading to the potential installation of a Remote Access Trojan (RAT) capable of exfiltrating sensitive data. Immediate action is required to safeguard your projects.

Immediate Action

  • Reinstall your dependencies to ensure you are using safe versions.
  • Rotate all credentials and secrets associated with your projects.
  • Verify your environment for any signs of compromise.
  • Stay informed through vendor advisories for ongoing updates.
  • Consult the security article for further guidance: Axios npm Compromise Guidance.

Affected Versions

  • axios@<=1.14.1 vulnerable; upgrade to axios@1.14.2+
  • axios@<=0.30.4 vulnerable; upgrade to axios@0.30.5+
  • @usebruno/cli users who installed during the attack window may be impacted.

Resolution Guide

To secure your environment, follow these commands:

npm uninstall @usebruno/cli
npm install @usebruno/cli
npm install axios@1.14.2

For additional hardening, pin the axios version in your package.json:

"axios": "1.14.2"

Example of a minimal patch snippet:

const axios = require('axios'); // Ensure axios is pinned to a safe version

Detection & Verification

To check if your installation is vulnerable, run:

npm list axios

This will show the installed version of axios. Ensure it is above 1.14.1 or 0.30.4. To verify the fix, execute:

npm audit

This command will check for vulnerabilities in your dependencies.

Risk and Impact

The exploitation of this vulnerability could lead to unauthorized access to your systems via a Remote Access Trojan (RAT). Attackers could exfiltrate sensitive data, including credentials, posing a significant risk to your projects and potentially leading to broader security breaches.

```

Keep reading