GHSA-rhgj-6g2c-frmm
NoneCVSS
—
EPSS
—
Published
Jun 10, 2026
CISA due date
—
The record
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hulumi/policies | 0 | 1.4.0 |
Related vulnerabilities
- GHSA-9vc9-4jv3-rf86 @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different… Also affects @hulumi/policies
- GHSA-g759-4pxw-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC… Also affects @hulumi/policies
- GHSA-59f3-7227-wmh4 @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance… Also affects @hulumi/policies
- GHSA-q2f7-m237-v562 @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition… Also affects @hulumi/policies
- GHSA-4xrh-5m3m-328w @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies Also affects @hulumi/policies
- GHSA-g43v-9x7q-83pq @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass Also affects @hulumi/policies
- CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. CWE-693
- CVE-2026-112077 A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. CWE-693