GHSA-9vc9-4jv3-rf86
NoneCVSS
—
EPSS
—
Published
Jun 10, 2026
CISA due date
—
The record
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hulumi/policies | 0 | 1.4.0 |
Related vulnerabilities
- GHSA-rhgj-6g2c-frmm @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name Also affects @hulumi/policies
- GHSA-g759-4pxw-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC… Also affects @hulumi/policies
- GHSA-59f3-7227-wmh4 @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance… Also affects @hulumi/policies
- GHSA-q2f7-m237-v562 @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition… Also affects @hulumi/policies
- GHSA-4xrh-5m3m-328w @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies Also affects @hulumi/policies
- GHSA-g43v-9x7q-83pq @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass Also affects @hulumi/policies
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
- CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284