Vulnerability Description
In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).
CVSS Score
5.9
MEDIUM
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Related Weaknesses (CWE)
References
- https://bun.com/blog/bun-v1.3.5
- https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-w
- https://www.scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-suppl
FAQ
What is CVE-2026-24910?
CVE-2026-24910 is a vulnerability with a CVSS score of 5.9 (MEDIUM). In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).
How severe is CVE-2026-24910?
CVE-2026-24910 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24910?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.