GHSA-gfp8-mp24-5vxg: @hulumi/baseline: CloudTrail selector tampering events were not fully detected

May 21, 2026

Impact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing coverage for changes to audit logging configuration.

Patched in 1.3.2: detection coverage and regression tests were expanded.

Remediation: upgrade @hulumi/baseline to 1.3.2 or later and rerun affected previews/checks.

References

github.com/advisories/GHSA-gfp8-mp24-5vxg
github.com/kerberosmansour/hulumi/security/advisories/GHSA-gfp8-mp24-5vxg

Code Behaviors & Features

Detect and mitigate GHSA-gfp8-mp24-5vxg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →