CyberRota Analysis
AI-GeneratedVersions of @hulumi/policies prior to 1.3.2 in GitHub are vulnerable due to improper validation of AWS IAM condition operators in OIDC trust policies. This flaw allows attackers to exploit ForAnyValue:StringLike operators, potentially bypassing security guardrails by concealing wildcard GitHub Actions OIDC subject conditions. Organizations using affected versions should prioritize remediation to mitigate the risk of unauthorized access and potential compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.