High · 8.8 CVE-2026-42994 EUVD-2026-26474GHSA-999x-2wm3-jfx8

Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to…

Published May 1, 2026 · Updated May 1, 2026 · Assigned by mitre

Vendor: bitwarden Product: Bitwarden CLI

Description

Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.

Affected products

Vendor	Product	Affected	Fixed
Bitwarden	Bitwarden CLI	2026.4.0	—

Advisories 1

WID-SEC-2026-1348 Bitwarden CLI (npm): Kompromittiertes Paket ermöglicht den Diebstahl von Anmeldedaten und die Exfiltration von Informationen BSI CERT-Bund (WID) · May 3, 2026

References

https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127