Live › vulnerability › CVE-2026-119288
Zuke is a Deno build automation library whose @zuke/core package launches Windows .cmd and .bat tools through cmd /c, so unquoted shell metacharacters in attacker-influenced arguments are reparsed by cmd.exe. An attacker who controls that text can run an extra command with the build's credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Only builds running on Windows that resolve a tool from node_modules/.bin and pass attacker-influenced text into its arguments are exposed. POSIX builds are not affected, and builds that never handle outside input in that way can skip it.
No product ranges from the sources yet.
deno info, and see whether it is below 1.51.0.1.51.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-119288")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.