@zuke/core EUVD-2026-114133

Exploitation requires all of: the build runs on Windows (POSIX platforms are never affected); the build resolves a tool from node_modules/.bin that exists as a .cmd or .bat shim (covers JavaScript-ecosystem wrappers); and the build passes attacker-influenced text - a branch name, a filename, or a parameter taken from repository content - as an argument to that wrapper. The injected text must contain an unquoted &, |, or ^ metacharacter with no surrounding space, since C-runtime quoting only quotes on spaces/tabs. Limiting factors that reduce real-world risk below the raw score: Windows-only, a build must actually be triggered (UI:R), a local batch shim must exist, the attacker must get crafted text into a wrapper argument, and only @zuke/core versions < 1.51.0 are vulnerable. The only complete fix is upgrading to 1.51.0; stated workarounds are not interpolating untrusted text into wrapper arguments on Windows runners, or pinning the tool to a non-batch executable with .toolPath(...).

Signals point to a genuine but bounded risk rather than a drop-everything emergency. The CVSS base score is 7.0 (High) with vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H: full confidentiality, integrity and availability impact (arbitrary command execution in the build context), but gated by local attack vector, high attack complexity, and required user interaction (a build must actually run). The vuln.today decision label is 'this_week', consistent with a serious-but-not-immediate priority. No CISA KEV listing is present, so there is no confirmed active exploitation, and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The supplied references are all patch/advisory artifacts (GHSA, PR #542, fix commit, release tag) - no public exploit or PoC reference is present - so this is 'no public exploit identified at time of analysis'. One nuance worth flagging: CVSS rates this AV:L, yet the attacker-influenced text (branch name, filename, repository-derived parameter) is frequently delivered via a remote source such as a pull request processed on a Windows CI runner, so the practical exposure of CI/CD pipelines may exceed what AV:L alone suggests - verify against your own runner topology. A data-quality issue also affects triage: the 'Microsoft' tag mislabels the vendor (Windows is only the affected platform; the product is the independent open-source zuke-build/zuke).

An attacker opens a pull request whose branch name or filename embeds a shell metacharacter with no surrounding space (for example &calc). When a Windows CI runner executes a Zuke build that forwards that attacker-influenced text as an argument to a tool resolved from node_modules/.bin (a .cmd/.bat shim), cmd.exe reparses the command line and runs the attacker's chosen command with the build's credentials. No public exploit code is identified; the attack requires Windows, a resolved batch shim, and a build that passes attacker-controlled text to a wrapper.