Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119290— Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Quick assessment

Affected
zuke-build zuke
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zuke 是一个面向 Deno 的、以代码为先且具备强类型特性的构建自动化系统。在 1.51.0 版本之前，@zuke/core 在调用 writeJobSummary 将渲染后的 reportSummary(...) 内容写入 GITHUB_STEP_SUMMARY 时，未应用用于保护 console 输出及持久化运行结果中已解析 secret() 值的脱敏机制。因此，若某个 GitHub Actions 构建流程将基于机密（secret）生成的文本写入摘要笔记，则可能以明文形式向所有有权查看该工作流运行记录的用

CVSS 7.5 · High

Possible ATT&CK Techniques 2 AI

T1552.001 · Credentials In Files T1038

Affected Version Matrix 1

VendorProduct Version RangeStatus
zuke-build zuke < 1.51.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119290

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Source: CVE Program / CVE List V5
Vulnerability Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zuke-build zuke < 1.51.0 -

II. Public POCs for CVE-2026-119290

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119290

请登录查看更多情报信息。

Other References for CVE-2026-119290 (4)

Same Patch Batch · zuke-build · 2026-10-30 · 5 CVEs total

CVE-2026-119287 8.0 HIGH Zuke: Command-form registry descriptors bypass the MCP launch policy
CVE-2026-119289 7.1 HIGH Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who
CVE-2026-119288 7.0 HIGH Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-pa
CVE-2026-119291 5.5 MEDIUM zuke setup and zuke import follow symbolic links planted at scaffold names, allowing write

IV. Related Vulnerabilities

Same product: zuke
Same vendor: zuke-build
Same weakness: CWE-532