Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119289— Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

Quick assessment

Affected
zuke-build zuke
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zuke 是一个面向 Deno 的、以代码优先且强类型的构建自动化系统。在 1.10.0 版本之前， 包中的 门控机制在关联触发的工作流运行时，仅依赖一个显示在运行列表中的“显示标题”（display-title）标记，而该标记可被其他调度者复制。在外部工作流仓库向不受发布仓库同等信任的实体授予 权限的配置中，攻击者可以使用该标记触发一次运行，导致门控机制在未验证事件类型、分支引用（ref）或创建时间窗口的情况下，直接采纳该运行的结论。若被替换的运行状态为“通过”，则可能授权一次未经验证的发布；若为“失败”或“已取

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
zuke-build zuke < 1.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119289

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
Source: CVE Program / CVE List V5
Vulnerability Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zuke-build zuke < 1.10.0 -

II. Public POCs for CVE-2026-119289

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119289

请登录查看更多情报信息。

Other References for CVE-2026-119289 (4)

Same Patch Batch · zuke-build · 2026-10-30 · 5 CVEs total

CVE-2026-119287 8.0 HIGH Zuke: Command-form registry descriptors bypass the MCP launch policy
CVE-2026-119290 7.5 HIGH Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing
CVE-2026-119288 7.0 HIGH Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-pa
CVE-2026-119291 5.5 MEDIUM zuke setup and zuke import follow symbolic links planted at scaffold names, allowing write

IV. Related Vulnerabilities

Same product: zuke
Same vendor: zuke-build
Same weakness: CWE-345