kerberosmansour/hulumi · Security
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
- GHSA ID
- GHSA-4xrh-5m3m-328w
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation.
Patched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests.
Remediation: upgrade @hulumi/policies to 1.3.2 or later.
CWEs
- CWE-269 · Improper Privilege Management