CVE-2026-119291 Details

A vulnerability in Zuke, a build automation system for Deno, allows for arbitrary file overwriting by following symbolic links at scaffolded names. This issue affects versions prior to 1.4.0 of the @zuke/cli package. The vulnerability arises because the 'zuke setup' and 'zuke import' commands, which are typically run in freshly cloned projects, use 'lstat' to check for symbolic links but then follow the links when reading, writing, and changing permissions. An attacker can exploit this by providing a malicious repository or template that includes a symbolic link, causing 'zuke' to overwrite files outside the intended directory using the user's permissions. The vulnerability is compounded by the fact that 'zuke import' can read linked content and incorporate it into the build file, potentially leading to further exploitation.

Users can upgrade to Zuke version 1.4.0 or later, where this vulnerability is fixed. For those using an earlier version, it's advisable to inspect repositories for symbolic links at critical scaffolded names before running 'zuke setup' or 'zuke import'.