CVE-2026-82862: Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-01
Weakness: CWE-426

Description

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

Affected products

kerberosmansour hulumi: before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: kerberosmansour hulumi 1.3.2. Check the vendor advisory for mitigations.

References

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-mjcg-x5mr-27ww
https://www.vulncheck.com/advisories/hulumi-before-1.3.2-helper-script-shadowing-via-workspace-files

Get alerted when CVE-2026-82862 or the next vulnerability affects your stack