AIKIDO-2025-10281
github.com/pulumi/esc is vulnerable to Integer Overflow
44
Medium Risk
This Affects:
github.com/pulumi/escTL;DR
Affected versions of this package are vulnerable to integer overflow in the writeYAMLEnvironmentDiagnostics function in cmd/esc/cli/env.go. The vulnerability arises from unsafe instantiation of hcl.NewDiagnosticTextWriter using potentially unbounded width values. The issue is addressed by first initializing the writer with a width of 0 and conditionally reinstantiating it only if the specified width is greater than 0, mitigating the risk flagged by gosec G115.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/pulumi/esc is vulnerable to Integer Overflow in versions 0.0.1 - 0.13.0.
How to fix this
Upgrade the github.com/pulumi/esc library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant