Hulumi CVE-2026-82862

Exploitation requires local write access to the target Hulumi workspace directory to plant a file that shadows the threat-model helper script. The vulnerable code path triggers specifically during local skill execution - the attack is not passive; a Hulumi skill must be invoked by the victim or an automated process after the malicious file is in place. The vulnerability only affects Hulumi installations prior to v1.3.2. Exploitation does not require elevated OS privileges beyond workspace write access and does not require network access. Factors limiting exploitation include the local-only attack vector, the prerequisite of write access to a specific workspace directory, and the dependency on a subsequent skill execution event in that workspace.

The CVSS 4.0 base score of 8.6 reflects low-complexity local exploitation with full confidentiality, integrity, and availability impact on the vulnerable system. The local attack vector (AV:L) significantly bounds opportunistic mass exploitation - an attacker must already have write access to the target workspace directory, ruling out internet-scale scanning campaigns. No EPSS score was supplied, there is no CISA KEV listing, and no public proof-of-concept has been identified, all suggesting limited active exploitation at the time of analysis. Real-world risk scales with how Hulumi workspaces are shared: isolated single-developer installations carry low practical exposure, while shared CI pipelines or multi-user development environments that process untrusted workspace content represent a meaningfully higher threat. The PR:N metric in a local context warrants verification - write access to a workspace may in practice represent an implicit access level that the raw metric does not fully convey.

An attacker who can write to a Hulumi workspace directory - through a shared CI pipeline, misconfigured directory ACLs, or a compromised collaborator account - places a malicious file named to shadow the threat-model helper script. When a developer or automated job next invokes a local Hulumi skill in that workspace, Hulumi resolves the helper from the unsafe root and executes the attacker's file with the victim user's OS privileges. No public proof-of-concept has been identified, but the technique is straightforward for any principal who achieves workspace write access.