PT-2026-48475 · Npm+2 · @Hulumi/Policies+1

CVE-2026-48033

·

Published

2026-06-10

·

Updated

2026-07-24

CVSS v4.0

8.4

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0
Description Policy packs can be bypassed using a forged Pulumi-URN logical name. The issue occurs because several policy rules check for a trusted substring anywhere within the URN, including the logical name portion which is controlled by the developer. An attacker or a compromised pull request could name a raw resource to include this trusted substring, causing the system to treat the resource as if it were part of a trusted parent component and skip mandatory hardening checks. This affects rules related to aws:s3:Bucket, github:Repository, cloudflare:Zone, and cloudflare:DnsRecord resources.
Recommendations Upgrade @hulumi/policies to version 1.4.0.

Exploit

Fix

Protection Mechanism Failure

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-48033
GHSA-RHGJ-6G2C-FRMM

Affected Products

@Hulumi/Policies
Hulumi