Skip to content
OpenAdvisories

Vendor

usebruno

4 known vulnerabilities.

usebruno at a glance

Last 12 months
2
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability, 1 critical May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202611
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202520
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

bruno 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.5
    CVE-2026-85665

    Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

    Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file…

    usebruno bruno
  • Critical 9.8
    CVE-2026-34841

    Axios npm Supply Chain Incident Impacting @usebruno/cli

    Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Troj…

    usebruno bruno @usebruno/cli npm
  • High 8.7
    CVE-2025-30354

    Bruno ignores Safe-Mode in Asserts expressions

    Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where…

    usebruno bruno
  • High 8.7
    CVE-2025-30210

    Bruno XSS On Environment Name

    Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover.…

    usebruno bruno