CVE-2026-119289: falha de alta gravidade em zuke-build zuke
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Produtos afetados
zuke-build · zukeCVEs relacionadas — zuke-build zuke
No mesmo produto, das mais perigosas para as menos.
CVE-2026-119290HIGHZuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runEPSS 0.5%CVE-2026-119287HIGHZuke: Command-form registry descriptors bypass the MCP launch policyEPSS 0.2%CVE-2026-119288HIGHZuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command lineEPSS 0.2%CVE-2026-119291MEDIUMzuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryEPSS 0.1%