CVE-2025-30354

Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno collection. The vulnerability is fixed in 1.39.1.

• CWE-942

• https://github.com/usebruno/bruno/security/advisories/GHSA-hffg-7v8v-79j3Exploit, Mitigation, Vendor Advisory

Published

Apr 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Fra…7.2
• CVE-2025-3035By first using the AI chatbot in one tab and later activatin…5.3
• CVE-2025-30350Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-30351Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2025-30352Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-30353Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2025-30355Synapse is an open source Matrix homeserver implementation. …7.5
• CVE-2025-30356CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-30357NamelessMC is a free, easy to use & powerful website softwar…6.8
• CVE-2025-30358Mesop is a Python-based UI framework that allows users to bu…8.1
• CVE-2025-30359webpack-dev-server allows users to use webpack with a develo…5.9
• CVE-2025-3036A vulnerability, which was classified as problematic, was fo…6.1