cve.bz

CVE-2026-82858

9.3 criticalEPSS 0.3%

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

CVSS 4.0
9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-25)
CWE
CWE-345
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2ffm-hxrq-qqmmnpm@hulumi/drift<1.3.21.3.2

References

Check your stackJSON