Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck
CVE-2026-82862Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
High 8.4
In plain English
A high-severity security flaw in hulumi from kerberosmansour. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 91.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kerberosmansour | hulumi | 0 – before 1.3.2 |
Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-mjcg-x5mr-27ww) vendor-advisory
- VulnCheck Advisory: Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files third-party-advisory