Which versions of Bitwarden CLI are affected by CVE-2026-42994?

Bitwarden CLI version 2026.4.0 distributed via npm on April 22, 2026 contained malicious code enabling unauthenticated remote command execution as part of a Checkmarx supply chain attack.

How to fix or mitigate CVE-2026-42994?

Within 24 hours: Inventory all Bitwarden CLI installations and identify any systems that pulled version 2026.4.0 between April 22, 2026 21:57Z-23:30Z via npm logs or package manager history. Isolate any confirmed affected systems from production networks and execute malware scanning with focus on process execution logs and command history. Within 7 days: Upgrade all Bitwarden CLI instances to version 2026.4.1 or later (vendor will release patched version); conduct forensic analysis of affected systems for unauthorized OS command execution, persistence mechanisms, and credential access. Within 30 days: Rotate all secrets and credentials managed by Bitwarden, particularly those accessed from compromised CLI instances; implement npm package pinning and hash verification for all Bitwarden dependencies; deploy behavioral monitoring on CLI execution paths.

Bitwarden CLI CVE-2026-42994

Q: What is the CVSS score of CVE-2026-42994?

CVE-2026-42994 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26474 HIGH

OS Command Injection (CWE-78)

2026-05-01 mitre

Command Injection Node.js

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 07:30 vuln.today

CVSS changed

May 01, 2026 - 05:22 NVD

8.8 (HIGH)

EUVD ID Assigned

May 01, 2026 - 05:00 euvd

EUVD-2026-26474

Analysis Generated

May 01, 2026 - 05:00 vuln.today

CVE Published

May 01, 2026 - 04:06 nvd

HIGH 8.8

DescriptionCVE.org

Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.

AnalysisAI

Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote command execution without authentication. The compromise was part of a broader Checkmarx supply chain attack targeting the npm registry. Users who installed this specific version during the 21:57Z-23:30Z window received a backdoored package capable of executing arbitrary OS commands. EPSS data not available for this recent CVE, but the supply chain vector and brief exposure window suggest targeted rather than mass exploitation.

Technical ContextAI

This is a software supply chain compromise (CWE-78: OS Command Injection) affecting the npm distribution channel for Bitwarden's command-line password manager client. The malicious code was embedded in version 2026.4.0 published to the npm registry, leveraging developers' trust in the official Bitwarden package namespace. Unlike traditional vulnerabilities in software logic, this represents direct tampering with the distribution artifact itself. The attack vector exploits the npm package manager ecosystem where dependencies are automatically fetched and installed via 'npm install @bitwarden/cli', making detection difficult until post-installation analysis. The Checkmarx reference suggests this may be related to compromised build infrastructure or developer credentials, similar to previous supply chain incidents affecting ua-parser-js, event-stream, and other npm packages.

RemediationAI

Immediately uninstall Bitwarden CLI 2026.4.0 if installed between 2026-04-22T21:57Z and 23:30Z via 'npm uninstall @bitwarden/cli' and reinstall from a verified clean version (check Bitwarden's official statement for confirmed safe versions post-incident). Audit npm install logs and package-lock.json files with timestamps in the compromise window - systems that pulled dependencies during this period require full compromise investigation including credential rotation, system imaging, and malware scanning. For CI/CD pipelines, review build logs from April 22, 2026 21:57Z-23:30Z and rebuild artifacts created during exposure. Rotate all secrets and API keys accessible to affected systems, as the command injection capability (CWE-78) could enable credential harvesting. Lock npm dependencies to specific hashes in package-lock.json rather than version ranges to prevent future supply chain attacks. Organizations should verify package integrity using npm audit signatures and consider using private npm registries with vulnerability scanning. No workaround exists for already-compromised installations - only complete removal and forensic analysis.