Bun is just the js runtime tool. At worst, you'll get a crash. If you are worried about bun security while granting permissions to Claude code...your worries are placed in the wrong place.
https://www.sentinelone.com/vulnerability-database/cve-2026-...
https://www.sentinelone.com/vulnerability-database/cve-2026-...