Vulnerabilities

TI-2026-58777 CVE-2026-85665 · GHSA-c887-2p5m-25wx

Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

MEDIUM 64

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00769 Published 2026-09-04 No fix listed CWE-22

TI-2026-27085 CVE-2026-34841 · GHSA-658g-p7jg-wx5g

Axios npm Supply Chain Incident Impacting @usebruno/cli

MEDIUM 48

Bruno is an open source IDE for exploring and testing APIs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00241 Published 2026-04-06 Fixed in 3.2.1 CWE-494

TI-2025-21660 CVE-2025-30354

Bruno ignores Safe-Mode in Asserts expressions

LOW 38

Bruno is an open source IDE for exploring and testing APIs.

CVSS 4.0HIGH 8.7 Local No auth User interaction EPSS 0.00376 Published 2025-04-01 Fixed in 1.39.1 CWE-942

TI-2025-21546 CVE-2025-30210

Bruno XSS On Environment Name

LOW 38

Bruno is an open source IDE for exploring and testing APIs.

CVSS 4.0HIGH 8.7 Local No auth User interaction EPSS 0.00359 Published 2025-04-01 Fixed in 1.39.1 CWE-80

TI-2024-32402 CVE-2024-48463 · GHSA-9394-rw2q-x5m7

Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or…

MEDIUM 62

Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00679 Published 2024-11-04 No fix listed CWE-601

Vulnerabilities

Filters

Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

Axios npm Supply Chain Incident Impacting @usebruno/cli

Bruno ignores Safe-Mode in Asserts expressions

Bruno XSS On Environment Name

Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or…