AIKIDO-2025-10281
github.com/pulumi/esc is vulnerable to Integer Overflow
44
Medium Risk
This Affects:
github.com/pulumi/escTL;DR
Affected versions of this package are vulnerable to integer overflow in the writeYAMLEnvironmentDiagnostics function in cmd/esc/cli/env.go. The vulnerability arises from unsafe instantiation of hcl.NewDiagnosticTextWriter using potentially unbounded width values. The issue is addressed by first initializing the writer with a width of 0 and conditionally reinstantiating it only if the specified width is greater than 0, mitigating the risk flagged by gosec G115.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/pulumi/esc is vulnerable to Integer Overflow in versions 0.0.1 - 0.13.0.
How to fix this
Upgrade the github.com/pulumi/esc library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant