CVE-2026-82862
Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 31, 2026
- Updated
- Sep 1, 2026
- Reserved
- Aug 31, 2026
Description
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-426 Untrusted Search Path
Affected Products
| Product | Versions |
|---|---|
hulumikerberosmansour |
|
References
- GitHub Security Advisory (GHSA-mjcg-x5mr-27ww)vendor-advisory
- VulnCheck Advisory: Hulumi before v1.3.2 Helper Script Shadowing via Workspace Filesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.