CVE-2026-119290 Details
Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
A vulnerability in the Zuke build automation system for Deno, specifically in the @zuke/core package prior to version 1.51.0, allows for the unintentional injection of workflow commands into the GitHub Actions runner. This occurs because the 'writeJobSummary' function fails to properly redact sensitive information derived from 'secret()' parameters before sending it to 'GITHUB_STEP_SUMMARY'. As a result, credentials can be exposed in cleartext to anyone viewing the workflow run, including unauthenticated users on public repositories. The issue arises when a summary note includes secret-derived text, which is not redacted in the job summary, leaving the information vulnerable until the run is deleted.
Upgrade to @zuke/core version 1.51.0 or later. This version applies the necessary redaction to the job summary before it is written, ensuring that secret-derived values are not exposed. If an upgrade is not possible, avoid including secret-derived information in summary notes or rotate any leaked credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7 | [email protected] | Source CodeVendor |
| https://github.com/zuke-build/zuke/pull/547 | [email protected] | Source CodeVendor |
| https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 | [email protected] | Release NotesVendor |
| https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zuke | < 1.51.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |