@hulumi/policies 1.2.0

Direct Vulnerabilities

Known vulnerabilities in the @hulumi/policies package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Access Control Bypass @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Access Control Bypass via the evaluation of AWS IAM condition operators in the trust policy inspection process. An attacker can bypass mandatory guardrails and introduce unsafe GitHub OIDC sub conditions by using set-qualified operators such as ForAnyValue:StringLike. How to fix Access Control Bypass? Upgrade `@hulumi/policies` to version 1.3.2 or higher.	<1.3.2
H Access Control Bypass @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Access Control Bypass via the `SecureBucket` evidence validation process. An attacker can bypass intended access controls by submitting spoofed parent evidence, causing policy evaluation to overlook unsafe bucket configurations. How to fix Access Control Bypass? Upgrade `@hulumi/policies` to version 1.3.2 or higher.	<1.3.2
H Improper Privilege Management @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Improper Privilege Management due to incomplete inspection of inline and attached IAM policy evidence in the `administrator-policy` guardrail. An attacker can gain unauthorized administrative privileges by crafting specific IAM policy paths that bypass policy evaluation. How to fix Improper Privilege Management? Upgrade `@hulumi/policies` to version 1.3.2 or higher.	<1.3.2
H Protection Mechanism Failure @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Protection Mechanism Failure via the `validators` process. An attacker can bypass intended security controls and suppress violations for different zones, hostnames, origins, or repositories by providing unrelated but compliant-looking evidence. How to fix Protection Mechanism Failure? Upgrade `@hulumi/policies` to version 1.3.2 or higher.	<1.3.2
H Access Control Bypass @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Access Control Bypass through the exemption mechanism for raw S3 buckets in the hardening policy check. An attacker can deploy an unhardened S3 bucket without required security controls by pairing it with decoy sibling resources that reference a different bucket, causing the compliance check to pass incorrectly. How to fix Access Control Bypass? Upgrade `@hulumi/policies` to version 1.4.0 or higher.	<1.4.0
H Incorrect Comparison @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Incorrect Comparison in the policy validation process. An attacker can bypass intended policy enforcement by configuring an IAM role to trust multiple OIDC providers, causing the validation to incorrectly skip checks for overly permissive wildcard conditions. How to fix Incorrect Comparison? Upgrade `@hulumi/policies` to version 1.4.0 or higher.	<1.4.0
H Protection Mechanism Failure @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected versions of this package are vulnerable to Protection Mechanism Failure through the URN parsing process. An attacker can bypass mandatory hardening checks by crafting a logical name containing trusted substrings, causing policy exemptions to be incorrectly applied. How to fix Protection Mechanism Failure? Upgrade `@hulumi/policies` to version 1.4.0 or higher.	<1.4.0

Vulnerability

Vulnerable Version

Access Control Bypass

@hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui

Affected versions of this package are vulnerable to Access Control Bypass via the evaluation of AWS IAM condition operators in the trust policy inspection process. An attacker can bypass mandatory guardrails and introduce unsafe GitHub OIDC sub conditions by using set-qualified operators such as ForAnyValue:StringLike.

How to fix Access Control Bypass?

Upgrade @hulumi/policies to version 1.3.2 or higher.

<1.3.2

Access Control Bypass

Affected versions of this package are vulnerable to Access Control Bypass via the SecureBucket evidence validation process. An attacker can bypass intended access controls by submitting spoofed parent evidence, causing policy evaluation to overlook unsafe bucket configurations.

How to fix Access Control Bypass?

Upgrade @hulumi/policies to version 1.3.2 or higher.

<1.3.2

Improper Privilege Management

Affected versions of this package are vulnerable to Improper Privilege Management due to incomplete inspection of inline and attached IAM policy evidence in the administrator-policy guardrail. An attacker can gain unauthorized administrative privileges by crafting specific IAM policy paths that bypass policy evaluation.

How to fix Improper Privilege Management?

Upgrade @hulumi/policies to version 1.3.2 or higher.

<1.3.2

Protection Mechanism Failure

Affected versions of this package are vulnerable to Protection Mechanism Failure via the validators process. An attacker can bypass intended security controls and suppress violations for different zones, hostnames, origins, or repositories by providing unrelated but compliant-looking evidence.

How to fix Protection Mechanism Failure?

Upgrade @hulumi/policies to version 1.3.2 or higher.

<1.3.2

Access Control Bypass

Affected versions of this package are vulnerable to Access Control Bypass through the exemption mechanism for raw S3 buckets in the hardening policy check. An attacker can deploy an unhardened S3 bucket without required security controls by pairing it with decoy sibling resources that reference a different bucket, causing the compliance check to pass incorrectly.

How to fix Access Control Bypass?

Upgrade @hulumi/policies to version 1.4.0 or higher.

<1.4.0

Incorrect Comparison

Affected versions of this package are vulnerable to Incorrect Comparison in the policy validation process. An attacker can bypass intended policy enforcement by configuring an IAM role to trust multiple OIDC providers, causing the validation to incorrectly skip checks for overly permissive wildcard conditions.

How to fix Incorrect Comparison?

Upgrade @hulumi/policies to version 1.4.0 or higher.

<1.4.0

Protection Mechanism Failure

Affected versions of this package are vulnerable to Protection Mechanism Failure through the URN parsing process. An attacker can bypass mandatory hardening checks by crafting a logical name containing trusted substrings, causing policy exemptions to be incorrectly applied.

How to fix Protection Mechanism Failure?

Upgrade @hulumi/policies to version 1.4.0 or higher.

<1.4.0

@hulumi/policies@1.2.0

Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically