Description

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-31T09:17:06.643Z",
  "pubdate": "2026-08-31T09:17:06.643Z",
  "executiveSummary": "Hulumi versions prior to v1.3.2 are susceptible to an arbitrary code execution vulnerability stemming from an insecure path resolution mechanism.\nThe vulnerability occurs because the application resolves a threat-model helper script from an untrusted workspace directory rather than a secure, predefined location.\nThis flaw allows a local attacker to perform file shadowing, where a malicious file is placed within the workspace to masquerade as the legitimate helper script.\nWhen a user triggers local skill execution, the application inadvertently executes the attacker-controlled script instead of the intended helper.\nThe impact includes the potential for full unauthorized code execution under the context of the user running the Hulumi tool, posing a severe risk to system integrity and sensitive data accessible by the user.\nSuccessful exploitation requires the attacker to have the ability to place files within the workspace that Hulumi processes. No remote network interaction is required, as the vector is local to the development environment.",
  "technicalDetails": "The vulnerability is rooted in an insecure filesystem search path implementation used by Hulumi when locating the 'threat-model' helper script.\nIn affected versions (pre-v1.3.2), the application's logic for resolving script dependencies fails to implement strict absolute path validation, defaulting instead to a search strategy that prioritizes the current working directory or the workspace root.\nThis behavior facilitates a path hijacking (shadowing) attack. If a workspace is configured such that an attacker can write to the directory where Hulumi executes or where the project files reside, the attacker can introduce a malicious executable file using the same filename as the legitimate helper script.\nThe attack flow follows these steps: 1) The attacker identifies or creates a target workspace directory. 2) The attacker places a malicious script at the location expected by the resolution logic, mimicking the naming convention of the 'threat-model' helper. 3) The attacker triggers the Hulumi application to execute a skill or process the threat model. 4) The application runtime performs a directory lookup for the helper script and encounters the attacker's malicious file first. 5) The runtime executes the malicious script with the privileges of the active user.\nBecause the resolution mechanism does not enforce cryptographic integrity checks or confirm that the helper script originates from an immutable or protected installation directory, the execution environment blindly trusts the binary found in the workspace.\nThe post-exploitation impact allows for arbitrary command execution. This may include, but is not limited to, unauthorized access to environment variables, access to local files, exfiltration of credentials stored within the workspace, or persistent modification of the local development environment.\nThe flaw does not require special authentication or network-level access, as it relies on the local file system structure and the user's interaction with the Hulumi toolset. The exposure is confined to the local machine but impacts any process managed or executed by Hulumi within a compromised workspace."
}