---
id: "CVE-2026-119287"
kind: "vulnerability"
aliases: ["CVE-2026-119287"]
title: "Zuke: MCP registry lets a writer run arbitrary commands on operator machine"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["build-tools", "deno", "mcp", "package", "zuke"]
not_affected_if: ["local-registry-only", "no-allow-run", "version-1.51.0-or-later"]
published_at: "2026-10-30T16:17:42+00:00"
first_seen_at: "2026-10-30T16:31:25+00:00"
updated_at: "2026-10-30T16:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119287", "first_seen_at": "2026-10-30T16:31:25+00:00"}]
---

# Zuke: MCP registry lets a writer run arbitrary commands on operator machine

Zuke is a Deno build automation tool whose MCP registry mode accepts command-form descriptors without the launch-host check applied to remote modules. A party able to write the registry can choose the program and arguments that run with the operator's environment and workspace access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Deno module version of `@zuke/core` is below `1.51.0`
- Check whether `zuke mcp --registry --allow-run` is used against a registry file writable by other parties
- The local registry populated only through `zuke register` is not affected per the source

## Fix

- `@zuke/core` `1.51.0`

## Timeline

- 2026-10-30T16:31:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119287

## From the sources

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_