Executive brief
@hulumi/drift is a tool used for managing and reconciling infrastructure state. A vulnerability in versions prior to 1.3.2 allows the system to accept and execute infrastructure change plans from untrusted sources without verifying their origin. This could allow an attacker to manipulate infrastructure configurations, potentially leading to unauthorized changes or loss of system integrity.
Technical details
The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity) within the orphan reconciler component of @hulumi/drift. The software fails to validate the provenance of 'execute plans' provided by external sources, treating them as trusted reconciliation instructions. An unauthenticated attacker can exploit this over the network to inject malicious execution plans. This results in high integrity impact as the system may perform unauthorized state changes based on the unverified input. The issue is resolved in version 1.3.2, which introduces provenance validation and rejects untrusted plans.
Affected products
- Hulumi @hulumi/drift < 1.3.2
Timeline
- 2026-05-15: disclosed: Initial disclosure by maintainer
- 2026-05-21: advisory: GitHub Advisory published
- 2026-05-21: patched: Fix released in version 1.3.2