CVE-2026-119288
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
CVSS Score
7.0
EPSS Score
0.0%
EPSS Percentile
0th
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
| CWE | CWE-78 |
| Vendor | zuke-build |
| Product | zuke |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for zuke-build zuke
Be the first to know when new high vulnerabilities affecting zuke-build zuke are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
zuke-build / zuke
< 1.51.0
References
github.com: https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95 github.com: https://github.com/zuke-build/zuke/pull/542 github.com: https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654 github.com: https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0