This vulnerability allows an attacker who supplies an execute plan to the @hulumi/drift tool to inject that plan without proper provenance validation. The flaw enables the execution of arbitrary, malicious operations intended to be treated as legitimate, which can result in unauthorized data manipulation or code execution. The weakness is categorized as CWE‑345, indicating a trust boundary violation where untrusted input is treated as trusted.

All releases of the hulumi:drift product before version 1.3.2 are affected. The vulnerability exists in any instance that accepts externally supplied execute plans from untrusted sources.

The CVSS score of 9.3 reflects a high severity risk; no EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this issue remotely by providing a crafted execute plan over a network or through any channel that the tool accepts. Once the plan is accepted, the attacker’s commands are executed with the same privileges as the running instance, exposing the system to full compromise if the tool is run with elevated rights.