Code-First Build Automation System Vulnerability in Zuke by Zuke

CVE-2026-119291

What is CVE-2026-119291?

Zuke is a build automation system for Deno that suffered from a vulnerability related to its handling of symbolic links. Before version 1.4.0, the @zuke/cli component would use lstat to check scaffold names but follow links during read, write, and permission operations. This flaw could be exploited by an attacker who provides a compromised cloned repository or template with a symbolic link, potentially leading to unauthorized overwrites outside the designated directory using the privileges of the user executing Zuke commands. The issue has been resolved in version 1.4.0, which users are strongly urged to upgrade to in order to mitigate risks.

References