Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @hulumi/policies | npm | < 1.4.0 | 1.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the use of unanchored string matching functions like includes() and startsWith() to validate Pulumi URNs across multiple policy packs. A Pulumi URN consists of a type chain and a developer-controlled logical name. The flawed logic did not distinguish between these two parts, allowing a malicious actor to craft a logical name containing a trusted substring (e.g., a parent component type). This would trick the policy into believing the resource was a legitimate child of a hardened component, causing the policy to be bypassed and leaving the resource without its mandatory security hardening. The patch addresses this by introducing a centralized, robust URN parser (packages/policies/src/urn.ts) that correctly separates the type chain from the logical name. All vulnerable policy checks were migrated to use this new anchored parsing logic, ensuring that validation is performed only on the trusted, non-user-controllable part of the URN.
cis_2_1_1_ssePresent.validateResourcepackages/policies/src/aws/cis-v5-pack.rules.ts
cis_2_1_5_tlsOnly.validateResourcepackages/policies/src/aws/cis-v5-pack.rules.ts
h4StartupHardenedRequiresLogging.validateStackpackages/policies/src/aws/hulumi-hardening-pack.ts
h5SecureBucketExemptionRequiresHardening.validateStackpackages/policies/src/aws/hulumi-hardening-pack.ts
isChildOfpackages/policies/src/cloudflare/hulumi-hardening-pack.ts
isChildOfSecureRepositorypackages/policies/src/github/hulumi-hardening-pack.rules.ts
isChildOfOrgFoundationpackages/policies/src/github/hulumi-hardening-pack.rules.ts
isChildOfpackages/policies/src/platform/deployment-governance-pack.ts