What is GHSA-g43v-9x7q-83pq?

GHSA-g43v-9x7q-83pq is a security advisory published by GitHub Security Advisories with High severity. @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

Why does GHSA-g43v-9x7q-83pq have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-g43v-9x7q-83pq?

GHSA-g43v-9x7q-83pq affects 1 product, including: npm/@hulumi/policies:\u003c 1.3.2.

GHSA-g43v-9x7q-83pqHighDisclosed before NVD

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

Vendor

GitHub Security Advisories

Published

May 21, 2026

Last Modified

May 21, 2026

📋 Description

Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing policy evaluation to miss an unsafe bucket shape. Patched in 1.3.2: the validator now correlates evidence to the expected component/resource relationship and includes regression coverage. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

🎯 Affected products1

npm/@hulumi/policies:< 1.3.2

🔗 References (2)

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
https://github.com/advisories/GHSA-g43v-9x7q-83pq