Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-24910 Bun Package Manager Dependency Trust Bypass in Versions Before 1.3.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24910
Post summary
The post discloses a dependency trust bypass vulnerability (CVE-2026-24910) affecting Bun Package Manager versions below 1.3.5, but offers no proof‑of‑concept, exploit code, or remediation details.
CVE-2026-24910 In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, … https://www.cve.org/CVERecord?id=CVE-2026-24910
Post summary
CVE-2026-24910 exposes a flaw in Bun before 1.3.5 that allows non‑npm packages to spoof the trusted dependencies list when a name matches, constituting a potential spoofing vulnerability.