Browse all 5 CVE security advisories affecting zuke-build. AI-powered Chinese analysis, POCs, and references for each vulnerability.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-119291 | zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory — zuke CWE-59 | 5.5 | Medium | 2026-10-30 |
| CVE-2026-119290 | Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run — zuke CWE-532 | 7.5 | High | 2026-10-30 |
| CVE-2026-119289 | Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate — zuke CWE-345 | 7.1 | High | 2026-10-30 |
| CVE-2026-119288 | Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line — zuke CWE-78 | 7.0 | High | 2026-10-30 |
| CVE-2026-119287 | Zuke: Command-form registry descriptors bypass the MCP launch policy — zuke CWE-862 | 8.0 | High | 2026-10-30 |
This page lists every published CVE security advisory associated with zuke-build. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.