Bun vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Bun products: 1 record(s), with severity, exploitation and fixes.

Bun 1

Exploited only (KEV) →

CVE-2026-24910 Medium · 5.9 CWE-348 Jan 27, 2026

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be…

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).