CVE-2025-30210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30210
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30210.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30210
Aliases
  • GHSA-fqxc-cxph-9vq8
Published
2025-04-01T14:16:57Z
Modified
2026-08-12T03:51:12Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Bruno XSS On Environment Name
Details

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30210.json"
}
References

Affected packages

Git / github.com/usebruno/bruno

Affected ranges

Type
GIT
Repo
https://github.com/usebruno/bruno
Events
Introduced
5f63cc4ab4ec00e33e42565c4496520f2bf93295
Fixed
b28b60d4a7bb3bdca3466e9c4e901025cdda3661
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:usebruno:bruno:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.38.0"
        },
        {
            "fixed": "1.39.1"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v1.*
v1.38.0
v1.38.1
v1.39.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30210.json"