A critical vulnerability in the Hulumi helper script resolution process allows unauthenticated local attackers to execute arbitrary code by shadowing scripts with malicious workspace files.

This vulnerability, categorized as CWE-426 (Untrusted Search Path), occurs because the application resolves threat-model helper scripts from an unsafe root directory. An unauthenticated attacker can place a malicious file within the local workspace to hijack the execution flow during local skill processing.

The ability for an attacker to execute arbitrary code on a local system poses a severe risk to data integrity, confidentiality, and system availability. Given the CVSS score of 8.4, this vulnerability represents a high-severity threat that could lead to full compromise of the affected environment, potentially facilitating lateral movement or the exfiltration of sensitive project data.

Immediate Action: Update the Hulumi software to version 1.3.2 or later, which resolves the unsafe search path issue.

Proactive Monitoring: Review system logs for unexpected file creation or modification events within workspace directories, particularly those involving script or executable extensions.

Compensating Controls: Implement strict file permission controls on workspace directories to ensure that only authorized users can create or modify files, effectively preventing the placement of malicious shadowing scripts.

Public Exploit Available: No

The security risk presented by CVE-2026-82862 is substantial due to the potential for full system compromise via arbitrary code execution. Organizations utilizing Hulumi should prioritize the immediate application of the vendor-provided security update to version 1.3.2 to eliminate the underlying untrusted search path vulnerability.