CVE-2026-119288— Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Quick assessment

Affected

zuke-build zuke

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zuke 是一个面向 Deno 的以代码为优先、强类型的构建自动化系统。在 1.51.0 版本之前，@zuke/core 在启动已解析的 Windows .cmd 和 .bat 软链接时，会通过在其前添加来执行，导致 cmd.exe 对使用 C 运行时引号规则组装的命令行进行重新解析。如果在 Windows 上运行的构建从解析工具，并传递了攻击者可控的、包含未加引号的、或等元字符的文本，则攻击者可在该构建的上下文中执行其选定的额外命令，并获取构建所拥有的凭据。POSIX 平台不受此问题影响。该问题已在 1

CVSS 7.0 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1203.002

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Source: CVE Program / CVE List V5

Vulnerability Description

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zuke-build	zuke	< 1.51.0	-

II. Public POCs for CVE-2026-119288

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119288

请登录查看更多情报信息。

Other References for CVE-2026-119288 (4)

https://github.com/zuke-build/zuke/pull/542 x_refsource_MISC
https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 x_refsource_MISC
https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95 x_refsource_CONFIRM
https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119288

Same Patch Batch · zuke-build · 2026-10-30 · 5 CVEs total

CVE-2026-119287	8.0 HIGH	Zuke: Command-form registry descriptors bypass the MCP launch policy
CVE-2026-119290	7.5 HIGH	Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing
CVE-2026-119289	7.1 HIGH	Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who
CVE-2026-119291	5.5 MEDIUM	zuke setup and zuke import follow symbolic links planted at scaffold names, allowing write

IV. Related Vulnerabilities

Same product: zuke

Same vendor: zuke-build

Same weakness: CWE-78