Skip to content
OpenAdvisories

Vendor

kerberosmansour

9 known vulnerabilities.

Products

hulumi 9
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.4
    CVE-2026-82862

    Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

    Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill executio…

    kerberosmansour hulumi
  • High 8.4
    CVE-2026-48036

    Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" —…

    kerberosmansour hulumi @hulumi/drift npm
  • High 7.1
    CVE-2026-48035

    Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by a…

    kerberosmansour hulumi @hulumi/baseline npm
  • High 8.4
    CVE-2026-48033

    Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.

    kerberosmansour hulumi @hulumi/policies npm
  • High 8.3
    CVE-2026-48032

    Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in …

    kerberosmansour hulumi @hulumi/policies npm
  • High 8.5
    CVE-2026-48034

    HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1…

    kerberosmansour hulumi @hulumi/policies npm