Vulnerabilidades em zuke-build
5 resultadosAnálise Vexday
O fornecedor zuke-build tem 5 CVEs registradas na base do Vexday, nenhuma delas listada no KEV (sem registro de exploração ativa conhecida) e nenhuma classificada como crítica pelo CVSS. A fraqueza dominante é a CWE-345 (verificação insuficiente de autenticidade dos dados), e todas as 5 vulnerabilidades foram publicadas nos últimos 90 dias, o que indica risco recente e ainda em acompanhamento.
CVE-2026-119290HIGHZuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runEPSS 0.5%CVE-2026-119287HIGHZuke: Command-form registry descriptors bypass the MCP launch policyEPSS 0.2%CVE-2026-119288HIGHZuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command lineEPSS 0.2%CVE-2026-119289HIGHZuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gateEPSS 0.2%CVE-2026-119291MEDIUMzuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryEPSS 0.1%