CyberRota Analysis
AI-GeneratedHulumi versions prior to 1.3.2 are vulnerable due to the threat-model helper script being resolved from an unsafe root, which allows workspace files to overshadow the intended script. This flaw enables attackers to introduce malicious files into the workspace, potentially executing arbitrary code during local skill execution. Organizations using affected versions should prioritize patching to mitigate the risk of code execution vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.