Read the docs
TI-2025-21546 Aliases CVE-2025-30210

Bruno XSS On Environment Name

Priority LOW 38CWE-80Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed bruno (usebruno): 1.39.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
usebrunobruno1.38.0 to before 1.39.11.39.1Patch availableCNA
  • bruno Vendorusebruno Affected 1.38.0 to before 1.39.1 Fixed in 1.39.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:usebruno:bruno:*:*:*:*:*:*:*:*before 1.39.1Vulnerableusebruno
  • cpe:2.3:a:usebruno:bruno:*:*:*:*:*:*:*:* Versions before 1.39.1 Vulnerable ·usebruno

Remediation

  • Fix · CNA bruno (usebruno) Fixed in 1.39.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30210

References

Exploit 1

  • TI-2024-32402 Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or… CVSS 3.1MEDIUM 6.5
  • TI-2026-27085 Axios npm Supply Chain Incident Impacting @usebruno/cli CVSS 3.1CRITICAL 9.8
  • TI-2025-21660 Bruno ignores Safe-Mode in Asserts expressions CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences