CVE-2026-24910

Published: Jan 27, 2026Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 1.4 / Impact: 4.0

Source: MITRE (Secondary)

Description

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).

Related CWEs

CWE-348

Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References (3)

https://bun.com/blog/bun-v1.3.5

Source: cve@mitre.org

https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act

Source: cve@mitre.org

https://www.scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-supply-chain-attack

Source: cve@mitre.org

Timeline

No history available yet.