Code Injection Vulnerability in Zuke Build Automation System for Deno
CVE-2026-119288
7HIGH
What is CVE-2026-119288?
The Zuke build automation system for Deno prior to version 1.51.0 contains a significant code injection vulnerability. This issue arises from the way the system handles command-line arguments on Windows. When using @zuke/core, if a build command resolves an external tool from the node_modules/.bin directory, it can execute additional commands injected by an attacker through specially-crafted input containing unquoted metacharacters such as &, |, or ^. This can lead to unintended command execution with the build's context and access to its credentials. The vulnerability has been addressed in version 1.51.0, which mitigates the risk associated with this issue.
Affected Version(s)
zuke < 1.51.0