CVE-2026-119288: high-severity vulnerability in zuke-build zuke
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.2%
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
zuke-build · zukeRelated CVEs — zuke-build zuke
In the same product, most dangerous first.
CVE-2026-119290HIGHZuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runEPSS 0.5%CVE-2026-119287HIGHZuke: Command-form registry descriptors bypass the MCP launch policyEPSS 0.2%CVE-2026-119289HIGHZuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gateEPSS 0.2%CVE-2026-119291MEDIUMzuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryEPSS 0.1%