Threats affecting pkg:github/zuke-build/zuke

CVE-2026-119291 is a vulnerability in zuke-build's zuke automation system prior to version 1.4.0. It involves improper handling of symbolic links during setup and import operations, allowing an attacker to supply a malicious repository or template with symbolic links that cause files outside the intended directory to be overwritten with the user's permissions. This can lead to unauthorized modification of files. The issue is fixed in version 1.4.0.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

Zuke-build versions prior to 1.10.0 contain a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies solely on a display-title marker visible in the workflow run list, which can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows an attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is resolved in version 1.10.0.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.