npmPackage

@hulumi/baseline

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-82863High 8.7
@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 15, 2026, 108 days before disclosure).
The latest release, 3.0.0, is not affected.
38% of @hulumi/baseline downloads last week were affected versions (15).
CVE-2026-48037Medium 6.3
Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released May 20, 2026, 65 days before disclosure).
The latest release, 3.0.0, is not affected.
49% of @hulumi/baseline downloads last week were affected versions (19).
CVE-2026-48035High 7.1
Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released May 20, 2026, 65 days before disclosure).
The latest release, 3.0.0, is not affected.
49% of @hulumi/baseline downloads last week were affected versions (19).