@zuke/cli CVE-2026-119291

Requires the victim to run zuke setup or zuke import (< 1.4.0) inside a directory whose contents come from an untrusted source - a cloned repository, downloaded template, or archive - in which the attacker has planted a symbolic link at one of the scaffolded names: .gitignore, deno.json, .mcp.json, zuke.ts, zuke, zuke.ps1, or zuke.json. The .gitignore read-rewrite path needs no flag; writing a launcher at the link's target and making it executable requires the --force flag; the import read-side triggers when it probes for source files by name and parses link-target content into the generated build file. Limiting factors that reduce realistic risk: the attacker must first get untrusted content onto the victim's disk (local vector), the victim must actively invoke the tool (user interaction), impact is bounded by the invoking user's permissions, and only versions below 1.4.0 are affected. Hard links are not detected by the probe but git cannot check them out, keeping them outside the threat.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.5 Medium) is self-consistent and matches the described mechanism: exploitation is local (the malicious symlink must already be on disk via an untrusted repo/template/archive) and requires the victim to actively run zuke setup or zuke import (UI:R), yielding high integrity impact (arbitrary file overwrite with the invoking user's permissions) but no direct confidentiality or availability loss. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code was identified - the supplied references are the GHSA advisory, PR #542, the fix commit, and the 1.4.0 release tag (patch artifacts), not a PoC. SSVC-style reasoning agrees with the vendor's this_month decision label: the flaw is not automatable (it depends on social-engineering a victim into cloning attacker content and running the tool) and technical impact is partial rather than total system compromise. One cross-source conflict: the input Tags include 'Information Disclosure', yet the CVSS vector sets C:N and the mechanism is fundamentally file overwrite (integrity); treat the disclosure framing with caution - the import read-side can incorporate link-target content into a generated build file, but that is indirect and not reflected in the scored confidentiality impact.

An attacker publishes a repository, template, or archive containing a symbolic link placed at one of the scaffold names zuke writes (e.g. .gitignore). A victim clones it and runs zuke setup inside it; zuke probes the name with lstat but then follows the link, rewriting a file outside the cloned directory with the victim's permissions - and under --force, writing and marking executable a launcher at the link's target. No public exploit code was identified at time of analysis, but exploitation requires only local untrusted content plus the victim running the normal setup/import command.