Is CVE-2026-82862 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82862?

CVE-2026-82862 has a CVSS v3 severity of HIGH (8.4).

Back

CVE-2026-82862

Description

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.