HIGH

GHSA-4xrh-5m3m-328w

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

Quick fix

GHSA-4xrh-5m3m-328w — @hulumi/policies: upgrade to the fixed version with the command below.

npm install @hulumi/policies@1.3.2

Details

Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation.

Patched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests.

Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@hulumi/policies

Introduced in: 0Fixed in: 1.3.2

Fixnpm install @hulumi/policies@1.3.2

References

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-4xrh-5m3m-328w[WEB]
https://github.com/kerberosmansour/hulumi[PACKAGE]