External risk intelligence

Bruno CLI Supply Chain Attack Deploys Remote Access Trojan

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34841

The vulnerability exists in a development tool (an IDE) and was introduced through a compromised supply chain dependency during the installation process. It is a build-time/developer-environment issue rather than an internet-facing service or appliance.

Usebruno Bruno

before 3.2.1

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A supply chain attack impacted the @usebruno/cli tool, introducing a hidden remote access Trojan through a compromised dependency. This issue affects users who installed the tool within a specific timeframe and could potentially allow unauthorized access to systems. The main concern is confirming relevance and exposure.

Development tool compromised, hidden malware introduced.
Hidden malware in a widely used development tool.
Confirm if your development environment was exposed.

Attack Path

How an attacker could exploit the issue

Attackers could have compromised the Bruno development environment through a malicious update to a package manager dependency. This allowed a hidden Remote Access Trojan to be installed on the systems of users who installed the affected Bruno versions during a specific timeframe, potentially leading to system compromise.

No specific entry conditions.
Installing affected Bruno versions.
Risk of remote system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose systems to remote access by an attacker due to a compromised dependency within the Bruno IDE's installation process. Users who installed or updated the @usebruno/cli between specific UTC times on March 31, 2026, may have inadvertently installed a Remote Access Trojan (RAT).

Developer systems could be compromised.
Malicious code may install during `npm install`.
Unauthorized system control is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `usebruno` application owner or the platform team responsible for managing development tooling should investigate this supply chain compromise. The immediate first step is to identify all systems where `@usebruno/cli` was installed between the specified UTC times on March 31, 2026, and confirm if these instances are business-critical or exposed to risk.

Identify accountable tooling owner.
Verify impacted `@usebruno/cli` installations.
Plan upgrade and code scanning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Bruno software affected by CVE-2026-34841?

Bruno is an open-source integrated development environment (IDE) primarily used by developers to design, explore, and test Application Programming Interfaces (APIs). The affected component, @usebruno/cli, allows developers to run Bruno functionality directly from the command line, often integrated into automated workflows or local development environments.

How does CVE-2026-34841 classify the vulnerability?

This issue is categorized under CWE-494 (Download of Code Without Integrity Check) and CWE-506 (Embedded Malicious Code). It represents a supply chain attack where a trusted dependency was compromised to inject a hidden Remote Access Trojan (RAT) into the installation process, rather than a flaw in Bruno’s own source code.

When is a system impacted by this supply chain attack?

A system is only potentially impacted if the @usebruno/cli tool was installed or updated via npm between 00:21 UTC and 03:30 UTC on March 31, 2026. Installations performed outside of this specific window are not affected by the compromised dependency, and the vulnerability does not trigger through standard IDE usage after successful, clean installations.

Is my Bruno installation at risk according to Halo Surface Signal?

Halo Surface Signal notes that this risk is highly unlikely for typical internet-facing services. Because the vulnerability is confined to a developer-side build process and specific installation timeframes, it is primarily a risk to local developer workstations and internal build environments rather than public-facing production servers.

What steps should I take if I installed Bruno during the risk window?

First, identify all developer workstations or build machines that ran an npm install of @usebruno/cli during the affected March 31 timeframe. Once identified, upgrade the software to version 3.2.1 or later to remove the malicious dependency. It is also prudent to perform a security review of those specific machines for unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.