CVE-2025-30354 Overview
Bruno is an open source Integrated Development Environment (IDE) for exploring and testing Application Programming Interfaces (APIs). A defect in the assertion runtime caused assert expressions to execute in Developer Mode even when users selected Safe Mode. The sandbox settings were ignored when a single request was run or sent, allowing arbitrary JavaScript in assertions to execute outside the intended isolation boundary. Exploitation requires a user to import and run a malicious Bruno collection obtained from an untrusted source. The vulnerability is fixed in version 1.39.1.
Critical Impact
Malicious Bruno collections can execute arbitrary code with the privileges of the user running the Bruno IDE, bypassing the Safe Mode sandbox entirely.
Affected Products
- Usebruno Bruno (all versions prior to 1.39.1)
- Bruno desktop application on Windows, macOS, and Linux
- Bruno Command Line Interface (CLI) workflows that process untrusted collections
Discovery Timeline
- 2025-04-01 - CVE-2025-30354 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30354
Vulnerability Analysis
Bruno provides two script execution modes. Safe Mode isolates request scripts in a sandboxed context with restricted APIs. Developer Mode grants scripts full access to the Node.js runtime, including filesystem and network primitives.
The assertion runtime evaluates assert expressions defined inside a collection to validate response data. The code path that handles a single-request execution failed to propagate the configured sandbox mode into the assertion evaluator. As a result, assertion expressions executed under Developer Mode privileges regardless of the user's selection.
The issue is classified as [CWE-942] Permissive Cross-domain Policy with Untrusted Domains, reflecting the trust-boundary violation between imported collection content and the host environment.
Root Cause
The assertion runtime did not read or enforce the sandbox configuration flag before evaluating expressions on the single-request code path. This left assert expressions running with unrestricted JavaScript execution capabilities even when Safe Mode was configured in the collection settings.
Attack Vector
An attacker crafts a malicious Bruno collection containing weaponized assert expressions. The attacker distributes the collection through repositories, messaging channels, or social engineering. The victim imports the collection into Bruno and runs a single request. The assertion runtime executes the embedded JavaScript with the user's privileges, enabling file access, process spawning, and outbound network calls. See the Bruno GitHub Security Advisory GHSA-hffg-7v8v-79j3 for vendor details.
Detection Methods for CVE-2025-30354
Indicators of Compromise
- Bruno collection files (.bru) containing assert blocks with suspicious JavaScript such as require('child_process'), require('fs'), or outbound HTTP calls
- Bruno process spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or sh
- Outbound network connections from the Bruno application to unfamiliar hosts immediately after a collection import
- Newly created or modified files in user directories timestamped shortly after running an imported collection
Detection Strategies
- Monitor for Bruno application versions below 1.39.1 across developer endpoints using software inventory data
- Alert on process-tree events where the Bruno binary is the parent of shell interpreters or scripting hosts
- Inspect .bru collection files sourced from external repositories for require() calls or Node.js API usage inside assert blocks
Monitoring Recommendations
- Log endpoint process creation with full command line to capture Bruno child-process activity
- Track file downloads of Bruno collections from untrusted domains through web proxy or Endpoint Detection and Response (EDR) telemetry
- Correlate Bruno execution events with subsequent outbound connections to identify post-exploitation staging
How to Mitigate CVE-2025-30354
Immediate Actions Required
- Upgrade Bruno to version 1.39.1 or later on all developer workstations and Continuous Integration (CI) runners
- Audit imported collections for assert expressions that call Node.js APIs or invoke external commands
- Restrict Bruno collection imports to trusted internal repositories under version control
Patch Information
The vendor released the fix in Bruno 1.39.1. The patch ensures the assertion runtime honors the Safe Mode sandbox setting on the single-request execution path. Details are available in the Bruno GitHub Security Advisory GHSA-hffg-7v8v-79j3.
Workarounds
- Do not import or open Bruno collections received from untrusted sources until the patched version is installed
- Review any recently imported third-party collections and remove assert blocks containing arbitrary JavaScript before running requests
- Run Bruno under a low-privilege user account to limit the impact of any assertion-based code execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
