CVE-2026-82862: Untrusted Search Path in kerberosmansour hulumi

CVE-2026-82862 describes an untrusted search path vulnerability in the kerberosmansour hulumi product. Versions prior to v1.3.2 resolve a threat-model helper script from an unsafe root directory, allowing workspace files to override the legitimate helper script. This flaw enables an attacker with local access to place malicious files in the workspace, which are then executed during local skill execution, resulting in arbitrary code execution without requiring user interaction or privileges.

An attacker with local access can execute arbitrary code by placing malicious files in the workspace that shadow the legitimate helper script. This can lead to full compromise of the local environment where hulumi is executed. The vulnerability has a high CVSS 4.0 score of 8.6, reflecting its potential for significant impact without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v1.3.2, upgrading to v1.3.2 or later is likely the intended remediation once confirmed. Until then, avoid running hulumi in untrusted workspaces or restrict workspace file permissions to trusted users only.