GitHub Advisoryadvisory · npm

GHSA-4xrh-5m3m-328w @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

HIGH Published 2026-05-21 Modified 2026-05-21 Official page ↗
Ecosystem
npm
Packages
@hulumi/policies
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-269
Reviewed
2026-05-21

Affected packages

• npm @hulumi/policies: < 1.3.2 → fixed in 1.3.2

Description

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation. Patched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References