Pulumi: Security fixes for CVE-2026-34040, CVE-2026-39883, ghsa-3xc5-wrhm-f963, ghsa-hfvc-g4fc-pqhx, ghsa-xmrv-pmrh-hhx2 applied in versions: 3.299.0-r0
Multiple security vulnerabilities affect the Pulumi package, impacting versions up to but not including 3.299.0-r0. These issues have been addressed in version 3.299.0-r0 and later releases. The vulnerabilities are rated with medium severity. No known exploits are reported in the wild. The affected package is distributed in the Alpine ecosystem.
AI Analysis
Technical Summary
The Pulumi package contains multiple security vulnerabilities identified under CVE-2026-34040 and others, affecting versions up to <3.299.0-r0. These vulnerabilities have been resolved in version 3.299.0-r0. The issues are documented in the GCVE and OSV databases, with no CVSS score assigned. The vulnerabilities impact the Alpine ecosystem distribution of Pulumi. No active exploitation has been reported.
Potential Impact
The vulnerabilities could potentially allow attackers to exploit the affected Pulumi versions prior to 3.299.0-r0. However, no known exploits in the wild have been reported, and the severity is assessed as medium. The exact impact details are not provided in the source data.
Mitigation Recommendations
Upgrade Pulumi to version 3.299.0-r0 or later to apply the security fixes. Since a patch is available, updating to the fixed version is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.
Pulumi: Security fixes for CVE-2026-34040, CVE-2026-39883, ghsa-3xc5-wrhm-f963, ghsa-hfvc-g4fc-pqhx, ghsa-xmrv-pmrh-hhx2 applied in versions: 3.299.0-r0
Description
Multiple security vulnerabilities affect the Pulumi package, impacting versions up to but not including 3.299.0-r0. These issues have been addressed in version 3.299.0-r0 and later releases. The vulnerabilities are rated with medium severity. No known exploits are reported in the wild. The affected package is distributed in the Alpine ecosystem.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Pulumi package contains multiple security vulnerabilities identified under CVE-2026-34040 and others, affecting versions up to <3.299.0-r0. These vulnerabilities have been resolved in version 3.299.0-r0. The issues are documented in the GCVE and OSV databases, with no CVSS score assigned. The vulnerabilities impact the Alpine ecosystem distribution of Pulumi. No active exploitation has been reported.
Potential Impact
The vulnerabilities could potentially allow attackers to exploit the affected Pulumi versions prior to 3.299.0-r0. However, no known exploits in the wild have been reported, and the severity is assessed as medium. The exact impact details are not provided in the source data.
Mitigation Recommendations
Upgrade Pulumi to version 3.299.0-r0 or later to apply the security fixes. Since a patch is available, updating to the fixed version is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-DJ79575
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
Threat ID: 6a7f4426bf8831d53961f3aa
Added to database: 08/14/2026, 16:36:54 UTC
Last enriched: 09/09/2026, 14:58:25 UTC
Last updated: 09/27/2026, 01:47:41 UTC
Views: 33
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.