Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@hulumi/drift

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.4npmAmendedPublished

    @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

    CVE-2026-48036 · GHSA-32g3-35g9-wc9g

    Affected
    • npm @hulumi/drift < 1.4.0
    Fixed in
    1.4.0· Vendor fix available
    Issue
    Affected: @hulumi/drift < 1.4.0 — Fixed in: 1.4.0 — Severity: Medium — CWE-755 (Improper Handling of Exceptional Conditions) Summary @hulumi/drift runs four adapters that each ask a different question about whether a resource has drifted (Pulumi-state diff, provider-version change, CloudTrail event, etc.). A classifier combines the adapters' answers into a verdict like None / none, ConsoleBreakGlass / high, or Mixed / high, and caches the verdict for 6 hours by default. Two related bugs from one root cause — the classifier only read each adapter's detected: true/false field and ignored whether the adapter itself succeeded: 1. Cached "all clear" on adapter failure. When an adapter failed (e.g. transient network error from the Automation API), the classifier read detected: false, concluded "no drift", and cached the verdict as None / none for 6 hours. A single transient failure could mask real console-break-glass mutations for the rest of the window. 2. Mixed verdicts without real…

    Recommended action: Upgrade to 1.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. High, CVSS 8.7npmAmendedPublished

    @hulumi/drift: Orphan reconciler accepted externally supplied execute plans

    CVE-2026-82858 · GHSA-2ffm-hxrq-qqmm

    Affected
    • npm @hulumi/drift < 1.3.2
    Fixed in
    1.3.2· Vendor fix available
    Issue
    Impact: @hulumi/drift versions before 1.3.2 could accept externally supplied execute plans without sufficient provenance checks, allowing unsafe reconciliation input to be treated as trusted. Patched in 1.3.2: execute-plan handling now validates provenance and rejects untrusted plans, with regression coverage. Remediation: upgrade @hulumi/drift to 1.3.2 or later.

    Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →