3vulnerabilities
- Critical0 (0.0%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate2 (66.7%)
- Low0 (0.0%)
hulumi-baseline
Ecosystem: npm
Downloads: 156
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting hulumi-baseline, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-2mxr-p26x-mj73 | High | @hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-1059 (Insufficient Technical Documentation / Behavioral Inconsistency)** #### Summary The S3 bucket that `AccountFoundation` creates to receive CloudTrail and AWS Config audit logs is meant to be tamper-resistant — if someone with delete access can erase from it, the forensic trail is gone. There were three independent ways the protection could be silently weakened: 1. **No Write-Once-Read-Many on the startup-hardened audit bucket.** The startup-hardened tier hard-coded `objectLock: false` on the |
| GitHub (opens in a new tab) | |
| GHSA-cj8g-prcm-mfg5 | Moderate | @hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)** #### Summary `AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job. 1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence ins |
| GitHub (opens in a new tab) | |
| GHSA-gfp8-mp24-5vxg | Moderate | @hulumi/baseline: CloudTrail selector tampering events were not fully detectedImpact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing coverage for changes to audit logging configuration. Patched in 1.3.2: detection coverage and regression tests were expanded. Remediation: upgrade @hulumi/baseline to 1.3.2 or later and rerun affected previews/checks. |
| GitHub (opens in a new tab) |
- GHSA-2mxr-p26x-mj73High@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
< 1.4.0
**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-1059 (Insufficient Technical Documentation / Behavioral Inconsistency)** #### Summary The S3 bucket that `AccountFoundation` creates to receive CloudTrail and AWS Config audit logs is meant to be tamper-resistant — if someone with delete access can erase from it, the forensic trail is gone. There were three independent ways the protection could be silently weakened: 1. **No Write-Once-Read-Many on the startup-hardened audit bucket.** The startup-hardened tier hard-coded `objectLock: false` on the
CVE: CVE-2026-48035
- GHSA-cj8g-prcm-mfg5Moderate@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
< 1.4.0
**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)** #### Summary `AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job. 1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence ins
CVE: CVE-2026-48037
- GHSA-gfp8-mp24-5vxgModerate@hulumi/baseline: CloudTrail selector tampering events were not fully detected
< 1.3.2
Impact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing coverage for changes to audit logging configuration. Patched in 1.3.2: detection coverage and regression tests were expanded. Remediation: upgrade @hulumi/baseline to 1.3.2 or later and rerun affected previews/checks.
CVE: CVE-2026-82863