Zuke-build vulnerabilities
We track 4 vulnerabilities in Zuke-build products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Zuke-build vulnerabilities
- 7.5 High severity
zuke: Insertion of Sensitive Information into Log File
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in c
- 7.1 High severity
zuke: Insufficient Verification of Data Authenticity
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by a
- 7.0 High severity
zuke: Improper Neutralization of Special Elements used in an OS Command
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build run
- 8.0 High severity
zuke: Missing Authorization
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descript