EUVD-2026-26474Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess npm registry
-
DeliveryDownload malicious @bitwarden/cli 2026.4.0
-
Exploitnpm triggers install scripts
-
ExecutionExecute embedded OS commands
-
PersistExfiltrate credentials/code
-
ImpactEstablish persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires installation of Bitwarden CLI version 2026.4.0 via npm specifically between 2026-04-22T21:57Z and 2026-04-22T23:30Z. No special configuration, authentication, or user interaction needed beyond the standard 'npm install' command. The malicious code executes automatically during package installation through npm's script lifecycle hooks. Systems performing automated dependency updates, CI/CD builds, or scheduled npm installs during this 90-minute window are most at risk. Installations from non-npm distribution channels (GitHub releases, Snap, Homebrew, Chocolatey, direct binary downloads) are NOT affected regardless of timing. The narrow temporal window significantly limits exploitation scope compared to persistent vulnerabilities. |
| Impact | Extremely high real-world risk for the narrow exposure window. CVSS 8.8 with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation requiring no authentication, but the 90-minute publication window (21:57Z-23:30Z on 2026-04-22) significantly limits victim population compared to typical vulnerabilities. Impact is severe: VC:L/VI:H grants attackers code execution with integrity compromise on developer workstations and CI/CD pipelines where Bitwarden CLI is installed. The supply chain vector makes this automatable (installation triggers compromise), meeting SSVC criteria for immediate action despite limited temporal scope. No EPSS score available due to recency, and no CISA KEV listing yet - likely because incident was contained quickly and affects only users who installed during the specific timeframe. Risk concentrated among automated systems (CI/CD, scheduled scripts) that may have pulled the malicious version without human review. Defenders must verify installation timestamps against the compromise window rather than just checking version numbers. |
| Exploit ScenarioDerived | Developer runs 'npm install @bitwarden/cli' or 'npm update' during the 21:57Z-23:30Z window on April 22, 2026, automatically pulling version 2026.4.0 from npm. The malicious package executes embedded commands during installation via npm lifecycle hooks (preinstall/postinstall scripts) with the privileges of the user running npm, typically a developer account or CI/CD service account. Attacker gains immediate command execution on the system without further interaction, enabling data exfiltration from the developer workstation (source code, credentials stored in environment variables or configuration files) or establishing persistence for long-term access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 01, 2026
Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote command execution without authentication. The compromise was part of a broader Checkmarx supply chain attack targeting the npm registry. Users who installed this specific version during the 21:57Z-23:30Z window received a backdoored package capable of executing arbitrary OS commands. EPSS data not available for this recent CVE, but the supply chain vector and brief exposure window suggest targeted rather than mass exploitation.
RemediationAI
Immediately uninstall Bitwarden CLI 2026.4.0 if installed between 2026-04-22T21:57Z and 23:30Z via 'npm uninstall @bitwarden/cli' and reinstall from a verified clean version (check Bitwarden's official statement for confirmed safe versions post-incident). Audit npm install logs and package-lock.json files with timestamps in the compromise window - systems that pulled dependencies during this period require full compromise investigation including credential rotation, system imaging, and malware scanning. For CI/CD pipelines, review build logs from April 22, 2026 21:57Z-23:30Z and rebuild artifacts created during exposure. Rotate all secrets and API keys accessible to affected systems, as the command injection capability (CWE-78) could enable credential harvesting. Lock npm dependencies to specific hashes in package-lock.json rather than version ranges to prevent future supply chain attacks. Organizations should verify package integrity using npm audit signatures and consider using private npm registries with vulnerability scanning. No workaround exists for already-compromised installations - only complete removal and forensic analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a software supply chain compromise (CWE-78: OS Command Injection) affecting the npm distribution channel for Bitwarden's command-line password manager client. The malicious code was embedded in version 2026.4.0 published to the npm registry, leveraging developers' trust in the official Bitwarden package namespace. Unlike traditional vulnerabilities in software logic, this represents direct tampering with the distribution artifact itself. The attack vector exploits the npm package manager ecosystem where dependencies are automatically fetched and installed via 'npm install @bitwarden/cli', making detection difficult until post-installation analysis. The Checkmarx reference suggests this may be related to compromised build infrastructure or developer credentials, similar to previous supply chain incidents affecting ua-parser-js, event-stream, and other npm packages.
Know when Bitwarden Cli gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.
Executive ViewAI
Bitwarden CLI version 2026.4.0 distributed via npm on April 22, 2026 contained malicious code enabling unauthenticated remote command execution as part of a Checkmarx supply chain attack. Any organization using this specific version during the 90-minute compromise window (21:57Z-23:30Z) faces critical risk of system compromise and credential theft, particularly given Bitwarden's role in secrets management. Immediate inventory and remediation of affected installations is required to prevent lateral movement and data exfiltration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately uninstall Bitwarden CLI 2026.4.0 from all systems; (2) Restrict npm registry access and enforce package version pinning to prevent future transitive compromises; (3) Implement mandatory code signing verification for all npm-installed packages; (4) Deploy host-based intrusion detection focused on CLI process spawning and OS command execution patterns; (5) Assume compromise of any secrets accessed via affected CLI version and execute emergency credential rotation; (6) Enable audit logging on all systems where CLI was executed to capture command execution history for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB