CVE-2026-119289 Details

A vulnerability exists in Zuke, a build automation system for Deno, in versions prior to 1.10.0. The issue arises within the '@zuke/gh' package, specifically in the 'githubWorkflow(...)' gate, which uses a display-title marker to correlate dispatched workflow runs. This marker can be easily copied and does not authenticate the run. In scenarios where the external workflow repository allows 'workflow_dispatch' permission to untrusted parties, an attacker can exploit this by dispatching a run with the marker. The gate will then adopt the run's conclusion without verifying key details, such as the event, reference, or creation window. As a result, a passing run can authorize an unvalidated release, while a failed or canceled run can block a legitimate one. This vulnerability is particularly concerning because the adopted run ID is persisted, allowing the substitution to survive across build resumes.

Users can upgrade to Zuke version 1.10.0, which addresses the vulnerability by implementing a more robust correlation process for workflow runs. The updated version ensures that the gate only adopts runs that are genuinely dispatched by the user, on the correct reference, and within the appropriate time window.