CVE-2025-30210 Overview
Bruno is an open source Integrated Development Environment (IDE) for exploring and testing Application Programming Interfaces (APIs). Versions prior to 1.39.1 contain a Cross-Site Scripting (XSS) vulnerability in custom tooltip components that internally use react-tooltip. The tooltip content, specifically the Environment name, was set as raw HTML and injected into the Document Object Model (DOM) on hover. Combined with loose Content Security Policy (CSP) restrictions, any valid HTML containing inline script executed when a user hovered over an Environment name. Exploitation requires a user to import a malicious Bruno or Postman collection from an untrusted source and hover over the crafted Environment name.
Critical Impact
Attackers can achieve arbitrary script execution within the Bruno application context by tricking users into importing malicious API collections, leading to potential data exfiltration and further compromise of the local environment.
Affected Products
- Usebruno Bruno versions prior to 1.39.1
- Bruno API IDE (Electron desktop application)
- Bruno-compatible Postman collection imports
Discovery Timeline
- 2025-04-01 - CVE-2025-30210 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30210
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting (XSS) issue classified under [CWE-80] — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Bruno's custom tooltip component wraps react-tooltip and passes the Environment name directly as raw HTML rather than as sanitized text. When a user hovers over the Environment label, the framework injects the attacker-controlled markup into the DOM without neutralizing script vectors.
Because Bruno ships as an Electron application with a permissive Content Security Policy, injected <script> tags and inline event handlers execute inside the renderer process. Script execution in this context grants access to Bruno's API request data, saved secrets in environment variables, and local file interactions available to the renderer.
Root Cause
The root cause is unsafe rendering of user-controlled input as HTML. The tooltip implementation passed the Environment name through a property that permits raw markup, bypassing React's default text escaping. A weak CSP failed to provide defense-in-depth against the resulting injection.
Attack Vector
The attack requires user interaction. An attacker crafts a Bruno or Postman collection export containing an Environment whose name embeds HTML with an inline script payload. The victim imports the collection from an untrusted source and hovers the mouse pointer over the Environment name. The payload executes with the privileges of the Bruno renderer process.
No verified exploit code has been published. The GitHub Security Advisory GHSA-fqxc-cxph-9vq8 describes the injection sink and fix. See the Bruno GitHub Security Advisory for technical details.
Detection Methods for CVE-2025-30210
Indicators of Compromise
- Bruno or Postman collection files (.json) containing HTML tags, <script> elements, or inline event handlers such as onerror= and onmouseover= inside Environment name fields.
- Unexpected outbound network connections initiated by the Bruno renderer process shortly after opening an imported collection.
- Modifications to Bruno collection files sourced from untrusted repositories, forums, or messaging platforms.
Detection Strategies
- Statically scan imported collection JSON for HTML metacharacters (<, >, ") in Environment name fields before opening in Bruno.
- Monitor Electron child processes spawned by Bruno for anomalous command lines or scripting engine invocations.
- Inspect endpoint telemetry for the Bruno process making unusual DNS queries or HTTP requests to attacker-controlled infrastructure.
Monitoring Recommendations
- Log all imports of external Bruno and Postman collections and correlate with user download activity.
- Alert on Bruno versions below 1.39.1 reported by software inventory tools.
- Track file writes and clipboard access performed by the Bruno process to identify potential data exfiltration.
How to Mitigate CVE-2025-30210
Immediate Actions Required
- Upgrade Bruno to version 1.39.1 or later on all developer workstations.
- Audit existing Bruno workspaces for collections imported from external sources and remove untrusted content.
- Educate developers to treat shared API collections as untrusted input, similar to executable attachments.
Patch Information
The vulnerability is fixed in Bruno 1.39.1. The maintainers corrected the tooltip component to render Environment names as text rather than raw HTML and tightened related sanitization. Refer to the Bruno GitHub Security Advisory GHSA-fqxc-cxph-9vq8 for the associated commit and release notes.
Workarounds
- Do not import Bruno or Postman collections from untrusted sources until the patch is applied.
- Manually inspect collection JSON files for HTML or JavaScript content in Environment name fields before opening.
- Restrict the Bruno application's network egress and file system access through host-based controls until the upgrade is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
