PT-2026-5032
CVE-2026-24910
·
Published
2026-01-27
·
Updated
2026-01-28
Description by
CVSS 3.1
5.9
MediumMetricsAV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Bun versions prior to 1.3.5
Description
The default trusted dependencies list in Bun can be manipulated by a non-npm package if the package name matches an existing trusted dependency. This affects dependencies installed via file, link, or git/github sources.
Recommendations
Update to version 1.3.5 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾