CVE-2025-30210
Last modified
CVE-2025-30210 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Usebruno | Bruno | < 1.39.1 |
References
- https://github.com/usebruno/bruno/security/advisories/GHSA-fqxc-cxph-9vq8Exploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-30210?
How severe is CVE-2025-30210?
How do I fix CVE-2025-30210?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-30205kanidim-provision is a helper utility that uses kanidm's API…7.6
- CVE-2025-30206Dpanel is a Docker visualization panel system which provides…9.8
- CVE-2025-30207Kirby is an open-source content management system. A vulnera…7.5
- CVE-2025-30208Vite, a provider of frontend development tooling, has a vuln…7.5
- CVE-2025-30209Tuleap is an Open Source Suite to improve management of soft…5.3
- CVE-2025-3021Path Traversal vulnerability in e-solutions e-management. Th…8.7
- CVE-2025-30211Erlang/OTP is a set of libraries for the Erlang programming …7.5
- CVE-2025-30212Frappe is a full-stack web application framework. An SQL Inj…7.5
- CVE-2025-30213Frappe is a full-stack web application framework. Prior to v…8.8
- CVE-2025-30214Frappe is a full-stack web application framework. Prior to v…7.5
- CVE-2025-30215NATS-Server is a High-Performance server for NATS.io, the cl…9.6
- CVE-2025-30216CryptoLib provides a software-only solution using the CCSDS …9.1
Are you affected by CVE-2025-30210?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST