Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
Priority LOW 39CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.
Summary
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Fix Fixed hulumi (kerberosmansour): 1.3.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kerberosmansour | hulumi | before 1.3.2 | 1.3.2 | Patch available | CNA |
- hulumi Vendorkerberosmansour Affected before 1.3.2 Fixed in 1.3.2 Patch available CNA
Remediation
- Fix · CNA hulumi (kerberosmansour) Fixed in 1.3.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
kerberosmansour hulumi 1.3.2
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-57163 hulumi before v1.3.2 SCP Template Tag-on-Create BypassPriority MEDIUM 49
- TI-2026-57161 hulumi before v1.3.2 Privilege Escalation via IAM PolicyPriority MEDIUM 49
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82862
- 2026-10-03 Alias added: GHSA-ffgq-3pgp-p595
References
More kerberosmansour vulnerabilities
- TI-2026-57163 hulumi before v1.3.2 SCP Template Tag-on-Create Bypass CVSS 4.0CRITICAL 9.3
- TI-2026-57161 hulumi before v1.3.2 Privilege Escalation via IAM Policy CVSS 4.0CRITICAL 9.3
- TI-2026-35479 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts CVSS 4.0HIGH 8.4
- TI-2026-35475 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers CVSS 4.0HIGH 8.3
- TI-2026-35477 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket CVSS 4.0HIGH 8.5
- TI-2026-35476 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name CVSS 4.0HIGH 8.4
Sources
- CVE-2026-82862 · CVE Program
- CVE-2026-82862 · NVD
- FIRST EPSS
- GHSA-ffgq-3pgp-p595 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences