CVE-2026-82862— Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
Quick assessment
Affected
kerberosmansour hulumi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 v1.3.2 之前的 Hulumi 版本中，威胁模型（threat-model）辅助脚本从一个不安全的根目录进行解析，这允许工作区中的文件“遮蔽”（shadow）原本应被使用的辅助脚本。攻击者可以在工作区中放置恶意文件，从而在本地技能（skill）执行过程中执行任意代码。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82862
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
Source: CVE Program / CVE List V5
Vulnerability Description
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| kerberosmansour | hulumi | 0 ~ 1.3.2 | - |
|
II. Public POCs for CVE-2026-82862
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82862
请登录查看更多情报信息。
Other References for CVE-2026-82862 (2)
Same Patch Batch · kerberosmansour · 2026-08-31 · 3 CVEs total
| CVE-2026-82859 | 9.8 CRITICAL | hulumi before v1.3.2 SCP Template Tag-on-Create Bypass |
| CVE-2026-82857 | 9.8 CRITICAL | hulumi before v1.3.2 Privilege Escalation via IAM Policy |
IV. Related Vulnerabilities
Same product: hulumi
-
CVE-2026-82859
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass -
CVE-2026-82857
hulumi before v1.3.2 Privilege Escalation via IAM Policy -
CVE-2026-48037
Hulumi: AccountFoundation reuse paths silently downgrade Gua -
CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and ov -
CVE-2026-48035
Hulumi: AccountFoundation audit-delivery S3 bucket could be
Same vendor: kerberosmansour
-
CVE-2026-82859
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass -
CVE-2026-82857
hulumi before v1.3.2 Privilege Escalation via IAM Policy -
CVE-2026-48037
Hulumi: AccountFoundation reuse paths silently downgrade Gua -
CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and ov -
CVE-2026-48035
Hulumi: AccountFoundation audit-delivery S3 bucket could be
Same weakness: CWE-426
-
CVE-2026-81697
openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative -
CVE-2026-75768
Substance3D - Painter | Untrusted Search Path (CWE-426) -
CVE-2026-78680
NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot -
CVE-2026-78155
Untrusted Search Path in StackGres -
CVE-2026-55769
CloudNativePG: Overriding operators can lead to privilege es
V. Comments for CVE-2026-82862
No comments yet