What is GHSA-wpxp-22v5-r9cx?

GHSA-wpxp-22v5-r9cx is a security advisory published by GitHub Security Advisories with Critical severity. @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient...

Which CVE IDs does GHSA-wpxp-22v5-r9cx cover?

GHSA-wpxp-22v5-r9cx covers the following CVE IDs: CVE-2026-82858. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wpxp-22v5-r9cx?

GHSA-wpxp-22v5-r9cx has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-wpxp-22v5-r9cxCriticalCVSS 9.8

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient...

Vendor

GitHub Security Advisories

Published

August 31, 2026

Last Modified

August 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-82858 →

📋 Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

🔗 References (4)

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2ffm-hxrq-qqmm
https://nvd.nist.gov/vuln/detail/CVE-2026-82858
https://www.vulncheck.com/advisories/hulumi-drift-before-1.3.2-unsafe-execute-plan-acceptance
https://github.com/advisories/GHSA-wpxp-22v5-r9cx