Skip to content
OpenAdvisories

Package · npm

@hulumi/drift

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-82858

    @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

    @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks t…

    hulumi drift @hulumi/drift npm
  • High 8.4
    CVE-2026-48036

    Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" —…

    kerberosmansour hulumi @hulumi/drift npm