Live › vulnerability › CVE-2026-119289
Zuke is a Deno build automation library whose @zuke/gh githubWorkflow gate matches a dispatched workflow run only by a display-title marker that anyone with dispatch permission can copy. An attacker who holds workflow_dispatch rights on the external workflow repository can have the gate accept their run's result, so an unvalidated release can pass or a valid release can be blocked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that use Zuke's @zuke/gh githubWorkflow gate to wait for a separate GitHub Actions workflow before releasing. The risk exists only when the workflow repository grants dispatch rights to someone the releasing repository does not fully trust. Projects that do not use the githubWorkflow gate, or whose dispatch permissions are limited to the same trusted group, are not exposed.
No product ranges from the sources yet.
@zuke/gh in deno.json, deno.lock or import statements and note the version.githubWorkflow(...) gate points at a workflow repository where people outside the releasing team hold workflow_dispatch permission.@zuke/gh (Zuke): move to or later1.10.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-119289")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.