Drift
Monthly
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.