CVE-2026-119288 Details
Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
A vulnerability in Zuke, a build automation system for Deno, allows for argument injection via Windows batch shims. This issue affects versions of Zuke prior to 1.51.0. The vulnerability arises because batch shims are launched through cmd.exe, which re-parses the command line according to C-runtime quoting rules. As a result, an argument containing certain metacharacters can be executed as an additional command within the build's context, potentially accessing sensitive credentials. The problem is specific to Windows and occurs when a tool is resolved from node_modules/.bin and untrusted text is passed as an argument.
Users can upgrade to Zuke version 1.51.0 or later, where this vulnerability is fixed. If an upgrade is not possible, avoid using untrusted text in command arguments on Windows, or pin the tool to a non-batch executable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654 | [email protected] | Source CodeVendor |
| https://github.com/zuke-build/zuke/pull/542 | [email protected] | Issue TrackingVendor |
| https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 | [email protected] | Release NotesVendor |
| https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zuke | < 1.51.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |