Code Injection Vulnerability in Zuke Build Automation System
CVE-2026-119289

7.1HIGH

Key Information:

Vendor: Zuke-build
Status: Zuke
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-119289?

The Zuke Build Automation System, prior to version 1.10.0, has a vulnerability in its @zuke/gh githubWorkflow(...) gate. This issue allows an attacker to exploit configurations where an external workflow repository grants workflow_dispatch permissions to untrusted parties. An attacker can dispatch a workflow run using a display-title marker, leading to unauthorized releases or blocking valid releases, depending on the status of the substituted run. Version 1.10.0 addresses this issue with improved validation mechanisms.