CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119289

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow... gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations...

CVE-2026-119290

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119287

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

CVE-2026-119288

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119291

Prior to version 1.4.0 , the @zuke/cli component of the Zuke build automation system for Deno is vulnerable to a symlink attack (CWE-59 ). While the tool uses lstat to inspect scaffold names, it performs link-following reads, writes, and permission changes during zuke setup and zuke import operat...

EUVD-2026-114137

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119291 zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119290

The @zuke/core component in the Zuke build automation system for Deno is vulnerable to information disclosure in versions prior to 1.51.0 . The root cause is that the writeJobSummary function writes reportSummary(...) notes to GITHUB_STEP_SUMMARY without applying the redactor required to protect ...

EUVD-2026-114136

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119290 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary... notes to GITHUBSTEPSUMMARY through writeJobSummary without applying the redactor that protects resolved secret values in console and persisted run output. A GitHub...

CVE-2026-119289

The Zuke build automation system for Deno is vulnerable in versions prior to 1.10.0 due to an insufficient verification of data authenticity in the @zuke/gh githubWorkflow(...) gate. The gate correlates dispatched workflow runs using only a display-title marker visible in the workflow run list. I...

EUVD-2026-114134

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow... gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations...

CVE-2026-119289 Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow... gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations...

CVE-2026-119288 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

EUVD-2026-114133

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119288 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

CVE-2026-119288

The build automation system Zuke is vulnerable to OS Command Injection in versions prior to 1.51.0 on Windows platforms. The root cause is that @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, which causes cmd.exe to re-parse command lines assembled using C-runtime q...

CVE-2026-119287

The Zuke build automation system for Deno (versions prior to 1.51.0 ) contains a vulnerability in the @zuke/core MCP registry mode. The system fails to apply the ZUKE_REGISTRY_LAUNCH_HOSTS authorization when processing command-form registry descriptors. If a run-capable caller invokes a tool from...