GitHub Advisoryadvisory · npm

GHSA-g43v-9x7q-83pq @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

HIGH Published 2026-05-21 Modified 2026-05-21 Official page ↗
Ecosystem
npm
Packages
@hulumi/policies
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-284
Reviewed
2026-05-21

Affected packages

• npm @hulumi/policies: < 1.3.2 → fixed in 1.3.2

Description

Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing policy evaluation to miss an unsafe bucket shape. Patched in 1.3.2: the validator now correlates evidence to the expected component/resource relationship and includes regression coverage. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References