High severity8.4NVD Advisory· Published Aug 31, 2026

CVE-2026-82862

Description

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hulumi/hulumillm-create
Range: <1.3.2

Patches

Vulnerability mechanics

References

github.com/kerberosmansour/hulumi/security/advisories/GHSA-mjcg-x5mr-27wwnvd
www.vulncheck.com/advisories/hulumi-before-1.3.2-helper-script-shadowing-via-workspace-filesnvd

News mentions

No linked articles in our index yet.

cvss	0.546
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000