CVE-2026-119287— Zuke: Command-form registry descriptors bypass the MCP launch policy

Quick assessment

Affected

zuke-build zuke

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zuke 是一个面向 Deno 的以代码为先、强类型的构建自动化系统。在 1.51.0 版本之前，@zuke/core 的 MCP 注册表模式在接收命令形式的注册表描述符时，未应用原本针对远程模块描述符所强制执行的 ZUKE_REGISTRY_LAUNCH_HOSTS 授权检查。当执行命令读取由其他方写入的注册表，且具备执行权限的调用者触发受影响的工具时，注册表的写入者即可选择要执行的程序及其参数，并能在操作者的环境与工作区访问权限下运行。由于描述符本身提供了名称，因此和的名称通配符无法规避此问题；此外，可选

CVSS 8.0 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1059.007 · JavaScript T1055.012 · Process Hollowing T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zuke: Command-form registry descriptors bypass the MCP launch policy

Source: CVE Program / CVE List V5

Vulnerability Description

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zuke-build	zuke	< 1.51.0	-

II. Public POCs for CVE-2026-119287

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119287

请登录查看更多情报信息。

Other References for CVE-2026-119287 (4)

https://github.com/zuke-build/zuke/pull/542 x_refsource_MISC
https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 x_refsource_MISC
https://github.com/zuke-build/zuke/security/advisories/GHSA-2rmh-5cw4-33gr x_refsource_CONFIRM
https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119287

Same Patch Batch · zuke-build · 2026-10-30 · 5 CVEs total

CVE-2026-119290	7.5 HIGH	Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing
CVE-2026-119289	7.1 HIGH	Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who
CVE-2026-119288	7.0 HIGH	Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-pa
CVE-2026-119291	5.5 MEDIUM	zuke setup and zuke import follow symbolic links planted at scaffold names, allowing write

IV. Related Vulnerabilities

Same product: zuke

Same vendor: zuke-build

Same weakness: CWE-862