{"id":"CVE-2026-119287","kind":"vulnerability","aliases":["CVE-2026-119287"],"related":[],"title":"Zuke: MCP registry lets a writer run arbitrary commands on operator machine","description":"Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.","summary":"Zuke is a Deno build automation tool whose MCP registry mode accepts command-form descriptors without the launch-host check applied to remote modules. A party able to write the registry can choose the program and arguments that run with the operator's environment and workspace access.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["build-tools","deno","mcp","package","zuke"],"not_affected_if":["local-registry-only","no-allow-run","version-1.51.0-or-later"],"how_to_check":"- Check the installed Deno module version of `@zuke/core` is below `1.51.0`\n- Check whether `zuke mcp --registry --allow-run` is used against a registry file writable by other parties\n- The local registry populated only through `zuke register` is not affected per the source","fix":"- `@zuke/core` `1.51.0`","status":"open","published_at":"2026-10-30T16:17:42+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:31:58+00:00","updated_at":"2026-10-30T16:31:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T16:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- `@zuke/core` `1.51.0`","reach":"local","title":"Zuke: MCP registry lets a writer run arbitrary commands on operator machine","impact":"high","summary":"Zuke is a Deno build automation tool whose MCP registry mode accepts command-form descriptors without the launch-host check applied to remote modules. A party able to write the registry can choose the program and arguments that run with the operator's environment and workspace access.","audience":"developers","category":"package","nicknames":[],"who_cares":["deno","zuke","mcp","build-tools"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker-chosen program runs with operator's environment and workspace access","analyst_note":"","how_to_check":"- Check the installed Deno module version of `@zuke/core` is below `1.51.0`\n- Check whether `zuke mcp --registry --allow-run` is used against a registry file writable by other parties\n- The local registry populated only through `zuke register` is not affected per the source","plain_action":"","needs_analyst":false,"not_affected_if":["local-registry-only","no-allow-run","version-1.51.0-or-later"],"who_is_affected":"Teams running zuke mcp in registry mode with --allow-run against a registry that another party can write to. The local default registry populated only through zuke register is not affected, according to the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4288,"output_tokens":509,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119287':15A,18A '-2026':14A,17A '1.51.0':90C,215C 'abl':54B 'accept':37B,96C 'access':74B,156C 'affect':137C,200C 'allow':120C,159C 'allow-run':119C,158C 'anoth':127C 'appli':48B,103C 'arbitrari':8A 'argument':64B,147C 'author':109C 'autom':31B,84C 'build':20B,30B,83C 'build-tool':19B 'caller':134C 'capabl':133C 'check':47B 'choos':60B,143C 'code':79C 'code-first':78C 'command':9A,39B,98C,203C 'command-form':38B,97C 'confirm':180C 'contain':167C 'control':184C 'cve':13A,16A 'default':191C 'deno':22B,29B,87C 'descript':183C 'descriptor':41B,101C,114C,172C,208C 'destruct':179C 'display':181C 'enforc':110C 'environ':71B,153C 'execut':148C 'first':80C 'fix':212C 'form':40B,99C,207C 'glob':164C 'host':46B,108C 'invok':135C 'issu':169C,210C 'launch':45B,107C 'launch-host':44B 'let':4A 'local':190C 'machin':12A 'mcp':2A,23B,34B,93C,117C 'mode':36B,95C 'modul':51B,113C,206C 'module-form':205C 'name':163C,175C 'oper':11A,69B,151C 'option':178C 'packag':24B 'parti':53B,128C 'popul':193C 'prior':88C 'program':62B,145C 'protect':162C 'read':122C 'regist':197C 'registri':3A,35B,58B,94C,100C,106C,118C,124C,140C,192C 'remot':50B,112C 'run':7A,66B,121C,132C,160C 'run-cap':131C 'strong':81C 'suppli':173C 'system':85C 'tool':21B,32B,138C 'type':82C 'version':214C 'whose':33B 'without':42B,102C 'workspac':73B,155C 'writabl':125C 'write':56B,204C 'writer':6A,141C,188C 'zuke':1A,25B,26B,75C,105C,116C,196C 'zuke/core':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running zuke mcp in registry mode with --allow-run against a registry that another party can write to. The local default registry populated only through zuke register is not affected, according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T16:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119287","severity":null,"published_at":"2026-10-30T16:17:42+00:00","modified_at":"2026-10-30T16:17:42+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}