zuke-build vulnerabilities
5 published CVEs name zuke-build among the affected products.
- 5Published CVEs5 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119291
zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory
zuke-build · zuke
Medium5.5 - CVE-2026-119290
Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
zuke-build · zuke
High7.5 - CVE-2026-119289
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
zuke-build · zuke
High7.1 - CVE-2026-119288
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
zuke-build · zuke
High7.0 - CVE-2026-119287
Zuke: Command-form registry descriptors bypass the MCP launch policy
zuke-build · zuke
High8.0