CVE-2026-119290

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119288

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119290

The @zuke/core component in the Zuke build automation system for Deno is vulnerable to information disclosure in versions prior to 1.51.0 . The root cause is that the writeJobSummary function writes reportSummary(...) notes to GITHUB_STEP_SUMMARY without applying the redactor required to protect ...

EUVD-2026-114136

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119288

The build automation system Zuke is vulnerable to OS Command Injection in versions prior to 1.51.0 on Windows platforms. The root cause is that @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, which causes cmd.exe to re-parse command lines assembled using C-runtime q...

CVE-2026-119288 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119288 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

EUVD-2026-114133

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119287 Zuke: Command-form registry descriptors bypass the MCP launch policy

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

EUVD-2026-114132

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

PT-2026-133663

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE REGISTRY LAUNCH HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry...

PT-2026-133664

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

PT-2026-133666

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUB STEP SUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119290: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...