EUVD-2026-114132Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain write access to shared build registry
-
DeliveryPlant command-form registry descriptor
-
ExploitRun-capable caller invokes affected MCP tool
-
ExecutionLaunch policy skips host authorization check
-
PersistSpawn attacker-chosen program as operator
-
ImpactExecute arbitrary commands with operator credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | All three must hold simultaneously: (1) the MCP server runs in registry mode with execution enabled via 'zuke mcp --registry --allow-run'; (2) the registry it reads is writable by someone other than the operator - a hosted HTTP registry sharing a single token, or a shared .zuke/builds directory; and (3) a run-capable caller invokes the affected tool. The specific flaw is that command-form registry descriptors are exempted from the ZUKE_REGISTRY_LAUNCH_HOSTS authorization applied to remote module-form descriptors. Limiting factors: --allow-run is not a default for a registry-mode server, the registry must be attacker-writable, and the tool must actually be invoked (UI:R). NOT affected: the local default registry populated only through 'zuke register', which writes module-form descriptors. The --allow-run/--protect name globs and the default-off --confirm-destructive prompt do not contain the issue because the descriptor supplies those names and the displayed description. |
| Impact | CVSS 8.0 (High) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity path requiring some privilege (PR:L) and user interaction (UI:R) that yields full confidentiality, integrity and availability loss via arbitrary command execution. The vuln.today decision label is 'this_week', indicating a prioritized-but-not-emergency posture. No EPSS probability was supplied, the CVE is not listed in CISA KEV, and no public exploit code was identified - so exploitation is a vendor-confirmed capability rather than an observed campaign. The real-world risk is genuine but strongly gated: three preconditions must all hold (registry-mode MCP server started with --allow-run, a registry writable by a second party, and a run-capable caller that invokes the affected tool). This makes it a targeted, trust-boundary issue (a shared build registry acting as a code-execution primitive) rather than a broad internet-exposed RCE. Signals are consistent - high technical impact per CVSS, confirmed by the vendor GHSA, but bounded by non-default configuration and the absence of KEV/EPSS/PoC evidence of active use. Missing data: no EPSS score and no SSVC automatable/technical-impact fields were provided to refine automatability. |
| Exploit ScenarioDerived | An attacker with write access to a Zuke build registry shared with the operator (a hosted HTTP registry sharing one token, or a shared .zuke/builds directory) inserts a command-form registry descriptor naming an arbitrary program and arguments. When the operator runs 'zuke mcp --registry --allow-run' and a run-capable caller invokes the affected tool, the launch policy returns 'allowed' without the ZUKE_REGISTRY_LAUNCH_HOSTS check, so the attacker's chosen command executes on the host as the operator with their environment and workspace, exposing cloud/CI/registry credentials. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Arbitrary command execution on hosts running the @zuke/core MCP server in registry mode is possible because command-form registry descriptors were exempted from the ZUKE_REGISTRY_LAUNCH_HOSTS authorization applied to remote module descriptors. Affected are @zuke/core versions prior to 1.51.0 where an operator runs 'zuke mcp --registry --allow-run' against a registry writable by another party (a hosted HTTP registry sharing one token, or a shared .zuke/builds directory) and a run-capable caller invokes the affected tool; the registry writer then chooses the program and arguments executed with the operator's environment and workspace access. The vendor addressed it in 1.51.0, and no public exploit code has been identified at time of analysis. The local default registry populated only through 'zuke register' is not affected because that command writes module-form descriptors.
RemediationAI
Vendor-released patch: upgrade @zuke/core to 1.51.0 (release tag core-v1.51.0, advisory GHSA-2rmh-5cw4-33gr, fix in PR #542 / commit 4257b0bc). After upgrading, command-form locations are refused unless the program is named in the new ZUKE_REGISTRY_LAUNCH_COMMANDS allow-list, matched case-folded against the program string exactly, with the refusal audited as launch_command_not_allowed and evaluated before the confirmation prompt so nothing is spawned; prefer absolute paths in that list because a relative program resolves against a working directory chosen by the same descriptor, and avoid naming interpreters such as sh or deno since that hands the registry writer full execution through their arguments. If upgrading is not immediately possible, the vendor's workarounds are to stop passing --allow-run to a registry-mode server (which removes tool execution from the MCP surface entirely) or to point the server only at a registry that nobody else can write to (which removes the attacker-writable descriptor source but requires enforcing write isolation on the hosted registry token or the shared .zuke/builds directory). Relying on --allow-run/--protect name globs or on --confirm-destructive is not a mitigation, as those controls consume names and descriptions supplied by the registry writer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zuke is a code-first, strongly typed build automation system for Deno, and its MCP (Model Context Protocol) server can expose build registry entries as callable tools. The registry supports two descriptor shapes: module-form descriptors that reference a remote entry module, and command-form descriptors that supply a program plus arguments directly. The launch policy exists to bound what the MCP host spawns, refusing a descriptor whose entry module is remote unless the operator names the origin in ZUKE_REGISTRY_LAUNCH_HOSTS. The flaw is CWE-862 (Missing Authorization): the command-form path was granted 'allowed' before any policy check ran, so the allow-list that guards remote module descriptors never applied to it. The surviving controls are name-based only - the --allow-run and --protect globs match names the descriptor itself supplies, and --confirm-destructive is off by default and displays a description written by the same registry author - so they do not bound execution. The fix introduces a ZUKE_REGISTRY_LAUNCH_COMMANDS allow-list; a command location is now refused unless its program string is named there, with a case-folded exact match, the refusal audited as launch_command_not_allowed, evaluated before the confirmation prompt, and nothing spawned. Two documented consequences are deliberate: a relative program resolves against a working directory chosen by the same descriptor, so absolute paths are preferable, and allow-listing an interpreter such as sh or deno effectively delegates full execution to the registry writer because the arguments remain theirs.
Know when Zuke gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attacker needs write access to a shared registry (PR:L) and a run-capable caller must invoke the tool (UI:R); a network-reachable hosted registry gives AV:N, with full C/I/A from arbitrary command execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.
Technical POC Analysis
CWE-862 (Missing Authorization), classified by the vendor as a bypass of the MCP launch policy.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity vulnerability in the @zuke/core MCP server (versions before 1.51.0) enables arbitrary command execution when running in registry mode with a writable registry. Organizations using this configuration face potential unauthorized access to host environments and sensitive data, impacting development and operations teams. Leadership should prioritize remediation to prevent exploitation.
No vendor-released patch identified at time of analysis; however, the vendor addressed the issue in version 1.51.0, so upgrade to that version. In the interim, avoid running 'zuke mcp --registry --allow-run' against registries writable by untrusted parties, restrict registry write access to authorized users, and use module-form descriptors via 'zuke register' where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Zuke's @zuke/core package before 1.51.0 writes rendered reportSummary(...) notes straight into the GitHub Actions job su
Release-gate substitution in the Zuke GitHub orchestration package @zuke/gh before 1.10.0 lets a party who can dispatch
Argument injection in Zuke's @zuke/core package (all versions before 1.51.0) on Windows lets attacker-influenced text pa
Symbolic-link following in Zuke CLI (@zuke/cli prior to 1.4.0) allows a repository, template, or archive supplied by an
Exploit-DB