Code Exposure Vulnerability in Zuke Build Automation System by Zuke
CVE-2026-119290

7.5HIGH

Key Information:

Vendor

Zuke-build

Status
Zuke
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119290?

The Zuke Build Automation System prior to version 1.51.0 contains a vulnerability where the @zuke/core package writes unprotected reportSummary notes to GITHUB_STEP_SUMMARY, potentially exposing sensitive credentials from secret-derived text in summary notes during GitHub Actions workflows. This allows unauthorized individuals or unauthenticated viewers of public repositories to access this sensitive information. The issue is resolved in version 1.51.0, which implements protective measures to redact such information from outputs.

Affected Version(s)

zuke < 1.51.0

References

https://github.com/zuke-build/zuke/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/zuke-build/zuke/pull/547
x_refsource_MISC
https://github.com/zuke-build/zuke/commit/a46fd7287c913d9...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.