Bitwarden CLI version 2026.4.0, when fetched from the npm registry, included embedded malicious code that can be executed when the package is installed. The vulnerability aligns with CWE‑78, indicating command‑dependent code execution, and with CWE‑94, indicating arbitrary code or instruction injection. This can lead to full compromise of the host system, including data exfiltration, persistence, or remote code execution, with wide‑scale impact if the CLI is used in automated environments. Based on the description, it is inferred that the malicious code could allow arbitrary command execution.

The affected product is the Bitwarden Command‑Line Interface (CLI) distributed via npm, specifically the 2026.4.0 release dated 2026‑04‑22. No other vendors or versions are listed in the current data.

The CVSS score of 8.8 classifies this issue as high risk. The EPSS score is < 1%, indicating a low but nonzero exploitation probability, and it is not currently listed in the CISA KEV catalog, but the supply‑chain nature of the compromise suggests that the vulnerability could be actively exploited in environments that routinely pull packages from npm. Attackers would gain execution privileges by installing or upgrading the compromised CLI, so based on the description, it is inferred that the primary attack vector is the compromised package distribution channel.