{"id":"GHSA-g43v-9x7q-83pq","aliases":[],"url":"https://o3.security/vulnerability/GHSA-g43v-9x7q-83pq","summary":"@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass","details":"Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing policy evaluation to miss an unsafe bucket shape.\n\nPatched in 1.3.2: the validator now correlates evidence to the expected component/resource relationship and includes regression coverage.\n\nRemediation: upgrade @hulumi/policies to 1.3.2 or later.","published":"2026-05-21T20:43:58Z","modified":"2026-05-21T21:00:15.965150277Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@hulumi/policies","fixedVersion":"1.3.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq"},{"type":"PACKAGE","url":"https://github.com/kerberosmansour/hulumi"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-21T21:00:15.965150277Z"}}