CVE-2026-42994 covers Bitwarden CLI 2026.4.0 as published on npm between 21:57 and 23:30 UTC on 22 April 2026, which carried embedded malicious code. It is scored CVSS 9.8 and tied to a Checkmarx supply chain incident. If you installed in that window, treat the machine as compromised.
What's affected
The record is narrow and specific. It covers Bitwarden CLI version 2026.4.0 obtained from npm between 2026-04-22T21:57Z and 2026-04-22T23:30Z. Copies installed outside that window, or from other sources, are not described by the record.
The record links to a Bitwarden community statement about the Checkmarx supply chain incident. I could not retrieve that page when preparing this guide, so I cannot add detail about the payload or the corrected release. Read the statement for the current guidance.
How to check if you're exposed
- List machines and CI jobs that install the CLI from npm. Search build scripts and Dockerfiles for the package name.
- Find the installed version.
bw --version
npm ls -g @bitwarden/cli
- Check when the install happened. Shell history, CI logs and the modification time of the package directory help. An install between 21:57 and 23:30 UTC on 22 April 2026 matches the record.
- For CI, look for cached node modules that were created in that window.
What to do now
- Find every install of the CLI that was pulled from npm on 22 April 2026 and decide whether it fell inside the window.
- For any machine inside the window, remove the package, treat it as compromised and rebuild it from a clean image if you can.
- Rotate secrets that the machine could reach, including vault credentials, tokens, SSH keys and cloud keys.
- Pin dependencies by exact version and lockfile hash in CI so a bad release cannot slide in.
- Read the Bitwarden statement for the corrected version and any further guidance.
Why it matters
The record lists CWE-78 (OS command injection) and CWE-94 (code injection) as the weakness types. Those labels describe what the embedded code could do on the machine rather than a coding mistake in a feature. This is a supply chain case: the code people trusted was altered on the way to them.
The window was short, about an hour and a half, but a package manager makes that enough. Anyone who ran an install in that period got the bad build. The KEV flag in the record is false, and the record does not describe victims or exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use the Bitwarden desktop app or browser extension?
The record only covers the CLI package from npm in the stated window. Read the Bitwarden statement for anything beyond that.
Is the vault itself compromised?
The record does not say. Treat secrets reachable from an affected machine as exposed and rotate them.
Sources
- Bitwarden statement on the Checkmarx supply chain incident (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
