CRITICAL
GHSA-q2f7-m237-v562
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
Quick fix
GHSA-q2f7-m237-v562 — @hulumi/policies: upgrade to the fixed version with the command below.
npm install @hulumi/policies@1.3.2Details
Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator keys in G_OIDC_1. Set-qualified operators such as ForAnyValue:StringLike could hide wildcard GitHub Actions OIDC sub conditions from the mandatory guardrail.
Patched in 1.3.2: the AWS trust-policy inspector now evaluates set-qualified string operators and rejects unsafe GitHub OIDC sub conditions.
Remediation: upgrade @hulumi/policies to 1.3.2 or later.
Are you affected?
Enter the version of the package you're using.