CVE-2026-119287: high-severity vulnerability in zuke-build zuke
Zuke: Command-form registry descriptors bypass the MCP launch policy
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.2%
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
zuke-build · zukeRelated CVEs — zuke-build zuke
In the same product, most dangerous first.
CVE-2026-119290HIGHZuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runEPSS 0.5%CVE-2026-119288HIGHZuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command lineEPSS 0.2%CVE-2026-119289HIGHZuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gateEPSS 0.2%CVE-2026-119291MEDIUMzuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryEPSS 0.1%