Authorization Flaw in Zuke's Build Automation System by Zuke

CVE-2026-119287

What is CVE-2026-119287?

The Zuke build automation system, prior to version 1.51.0, exhibits a vulnerability in its MCP registry mode where it permits command-form registry descriptors to be accepted without enforcing necessary authorization for remote module descriptors. This oversight allows a registry writable by another entity to dictate the program and arguments executed with the caller's environment. Such a scenario can be exploited if a malicious registry writer chooses to execute harmful commands, leveraging the --allow-run option, while the local default registry remains secure. The issue was rectified in version 1.51.0, underscoring the importance of proper authorization checks in automated systems.

References