Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-82858

@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

hulumi drift

Default version status: unaffected

  • 0 to < 1.3.2affected
  • 1.3.2unaffected
pkg:npm/%40hulumi/drift

References