@hulumi/policies vulnerabilities
CVEs whose affected-version data names the @hulumi/policies package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-48032High@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
▾ Twilighthulumi · @hulumi/policiesEPSS 0.54%via GHSA
CVE-2026-48033High@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
▾ Twilighthulumi · @hulumi/policiesEPSS 0.48%via GHSA
CVE-2026-48034High@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
▾ Twilighthulumi · @hulumi/policiesEPSS 0.45%via GHSA