Zuke
Monthly
Zuke's @zuke/core package before 1.51.0 writes rendered reportSummary(...) notes straight into the GitHub Actions job summary file without passing them through the run's secret redactor, so a note built from a resolved secret() value is published in cleartext. Anyone who can view the workflow run can read it - on a public repository that means unauthenticated viewers - and the summary artifact persists on the run until it is deleted. Exposure requires a build running under GitHub Actions that deliberately places secret-derived text in a summary note; builds that never summarize secrets, and runs outside GitHub Actions, are unaffected, and no public exploit has been identified at time of analysis (the issue is a disclosure defect rather than something an attacker triggers remotely).
Release-gate substitution in the Zuke GitHub orchestration package @zuke/gh before 1.10.0 lets a party who can dispatch the external workflow satisfy or block a release gate without the gated suite ever validating the shipped artifact. The githubWorkflow(...) gate located the run it had just dispatched purely by a display-title marker echoed into the run list, so anyone able to read that marker and dispatch the same workflow could raise a substitute run whose conclusion the gate adopted; a passing run authorizes an unvalidated release and a failed or cancelled run holds a valid release closed, and the persisted run ID keeps the substitution across build resume. Exploitation requires marker-mode use plus a separate repository whose workflow_dispatch / actions:write holders are not equally trusted by the releasing repository; no public exploit code was identified at time of analysis, and the issue is fixed in 1.10.0. CVSS 3.1 base score 7.1 (High) with integrity as the dominant impact.
Argument injection in Zuke's @zuke/core package (all versions before 1.51.0) on Windows lets attacker-influenced text passed to a resolved node_modules/.bin .cmd or .bat shim escape the argument boundary and be executed by cmd.exe as an additional attacker-chosen command, running in the build's own context with access to whatever credentials that build holds. Only Windows builds that resolve a batch shim and interpolate untrusted text - a branch name, a filename, or a parameter taken from repository content - into a wrapper argument are on the affected path; POSIX platforms were never affected and the CVSS vector records local attack, high attack complexity, no privileges required and user interaction required. The issue is fixed in 1.51.0, and no public exploit code was identified at time of analysis; the advisory notes the flawed launch path was the primary route for every wrapper resolving its tool from node_modules on Windows, not a rarely-taken fallback.
Arbitrary command execution on hosts running the @zuke/core MCP server in registry mode is possible because command-form registry descriptors were exempted from the ZUKE_REGISTRY_LAUNCH_HOSTS authorization applied to remote module descriptors. Affected are @zuke/core versions prior to 1.51.0 where an operator runs 'zuke mcp --registry --allow-run' against a registry writable by another party (a hosted HTTP registry sharing one token, or a shared .zuke/builds directory) and a run-capable caller invokes the affected tool; the registry writer then chooses the program and arguments executed with the operator's environment and workspace access. The vendor addressed it in 1.51.0, and no public exploit code has been identified at time of analysis. The local default registry populated only through 'zuke register' is not affected because that command writes module-form descriptors.
Symbolic-link following in Zuke CLI (@zuke/cli prior to 1.4.0) allows a repository, template, or archive supplied by an untrusted party to redirect the scaffolder's writes outside the selected directory, with the invoking user's permissions. Running `zuke setup` in such a directory lets a planted symlink at `.gitignore` be read through and rewritten with no flag required, and with `--force` the launcher is written at the link's target and made executable; `zuke import` additionally reads link-target content and parses it into the generated build file, giving a confidentiality-exposure angle. The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (5.5), reflecting that the attacker must first place content on disk and the victim must actively run the tool, and impact is capped by the invoking user's privileges; no public exploit was identified at time of analysis and there is no CISA KEV entry, so this is a moderate-priority item to address this month rather than an emergency.
Zuke's @zuke/core package before 1.51.0 writes rendered reportSummary(...) notes straight into the GitHub Actions job summary file without passing them through the run's secret redactor, so a note built from a resolved secret() value is published in cleartext. Anyone who can view the workflow run can read it - on a public repository that means unauthenticated viewers - and the summary artifact persists on the run until it is deleted. Exposure requires a build running under GitHub Actions that deliberately places secret-derived text in a summary note; builds that never summarize secrets, and runs outside GitHub Actions, are unaffected, and no public exploit has been identified at time of analysis (the issue is a disclosure defect rather than something an attacker triggers remotely).
Release-gate substitution in the Zuke GitHub orchestration package @zuke/gh before 1.10.0 lets a party who can dispatch the external workflow satisfy or block a release gate without the gated suite ever validating the shipped artifact. The githubWorkflow(...) gate located the run it had just dispatched purely by a display-title marker echoed into the run list, so anyone able to read that marker and dispatch the same workflow could raise a substitute run whose conclusion the gate adopted; a passing run authorizes an unvalidated release and a failed or cancelled run holds a valid release closed, and the persisted run ID keeps the substitution across build resume. Exploitation requires marker-mode use plus a separate repository whose workflow_dispatch / actions:write holders are not equally trusted by the releasing repository; no public exploit code was identified at time of analysis, and the issue is fixed in 1.10.0. CVSS 3.1 base score 7.1 (High) with integrity as the dominant impact.
Argument injection in Zuke's @zuke/core package (all versions before 1.51.0) on Windows lets attacker-influenced text passed to a resolved node_modules/.bin .cmd or .bat shim escape the argument boundary and be executed by cmd.exe as an additional attacker-chosen command, running in the build's own context with access to whatever credentials that build holds. Only Windows builds that resolve a batch shim and interpolate untrusted text - a branch name, a filename, or a parameter taken from repository content - into a wrapper argument are on the affected path; POSIX platforms were never affected and the CVSS vector records local attack, high attack complexity, no privileges required and user interaction required. The issue is fixed in 1.51.0, and no public exploit code was identified at time of analysis; the advisory notes the flawed launch path was the primary route for every wrapper resolving its tool from node_modules on Windows, not a rarely-taken fallback.
Arbitrary command execution on hosts running the @zuke/core MCP server in registry mode is possible because command-form registry descriptors were exempted from the ZUKE_REGISTRY_LAUNCH_HOSTS authorization applied to remote module descriptors. Affected are @zuke/core versions prior to 1.51.0 where an operator runs 'zuke mcp --registry --allow-run' against a registry writable by another party (a hosted HTTP registry sharing one token, or a shared .zuke/builds directory) and a run-capable caller invokes the affected tool; the registry writer then chooses the program and arguments executed with the operator's environment and workspace access. The vendor addressed it in 1.51.0, and no public exploit code has been identified at time of analysis. The local default registry populated only through 'zuke register' is not affected because that command writes module-form descriptors.
Symbolic-link following in Zuke CLI (@zuke/cli prior to 1.4.0) allows a repository, template, or archive supplied by an untrusted party to redirect the scaffolder's writes outside the selected directory, with the invoking user's permissions. Running `zuke setup` in such a directory lets a planted symlink at `.gitignore` be read through and rewritten with no flag required, and with `--force` the launcher is written at the link's target and made executable; `zuke import` additionally reads link-target content and parses it into the generated build file, giving a confidentiality-exposure angle. The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (5.5), reflecting that the attacker must first place content on disk and the victim must actively run the tool, and impact is capped by the invoking user's privileges; no public exploit was identified at time of analysis and there is no CISA KEV entry, so this is a moderate-priority item to address this month rather than an emergency.