@hulumi/baseline 1.3.2

Direct Vulnerabilities

Known vulnerabilities in the @hulumi/baseline package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Protection Mechanism Failure @hulumi/baseline is a Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release. Affected versions of this package are vulnerable to Protection Mechanism Failure in the reuse process for existing AWS GuardDuty and Security Hub services. An attacker can cause deployments to appear compliant while actually disabling or misconfiguring security monitoring by leveraging the reuse mode, which fails to verify the operational status of imported resources or may inadvertently unsubscribe accounts from compliance standards during stack destruction. How to fix Protection Mechanism Failure? Upgrade `@hulumi/baseline` to version 1.4.0 or higher.	<1.4.0
H Insufficient Technical Documentation @hulumi/baseline is a Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release. Affected versions of this package are vulnerable to Insufficient Technical Documentation due to insufficient enforcement of tamper-resistance in the `AccountFoundation` process. An attacker can erase or modify audit logs by exploiting misconfigurations such as disabled object lock, forwarding of `forceDestroy`, or lack of immutability controls in sandbox deployments. This can result in the loss of forensic evidence and undetectable tampering with audit trails. How to fix Insufficient Technical Documentation? Upgrade `@hulumi/baseline` to version 1.4.0 or higher.	<1.4.0

Vulnerability

Vulnerable Version

Protection Mechanism Failure

@hulumi/baseline is a Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release.

Affected versions of this package are vulnerable to Protection Mechanism Failure in the reuse process for existing AWS GuardDuty and Security Hub services. An attacker can cause deployments to appear compliant while actually disabling or misconfiguring security monitoring by leveraging the reuse mode, which fails to verify the operational status of imported resources or may inadvertently unsubscribe accounts from compliance standards during stack destruction.

How to fix Protection Mechanism Failure?

Upgrade @hulumi/baseline to version 1.4.0 or higher.

<1.4.0

Insufficient Technical Documentation

Affected versions of this package are vulnerable to Insufficient Technical Documentation due to insufficient enforcement of tamper-resistance in the AccountFoundation process. An attacker can erase or modify audit logs by exploiting misconfigurations such as disabled object lock, forwarding of forceDestroy, or lack of immutability controls in sandbox deployments. This can result in the loss of forensic evidence and undetectable tampering with audit trails.

How to fix Insufficient Technical Documentation?

Upgrade @hulumi/baseline to version 1.4.0 or higher.

<1.4.0

@hulumi/baseline@1.3.2

Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically