CVE-2025-30210

Description

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.

Reserved 2025-03-18 | Published 2025-04-01 | Updated 2025-04-02 | Assigner GitHub_M

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

>= 1.38.0, < 1.39.1
affected

References

github.com/.../bruno/security/advisories/GHSA-fqxc-cxph-9vq8

cve.org (CVE-2025-30210)

nvd.nist.gov (CVE-2025-30210)

Download JSON