Kerberosmansour
Monthly
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.