Live › vulnerability › CVE-2026-119290
Zuke, a Deno build automation library, writes rendered report notes to the GitHub Actions job summary without redacting secret values. An attacker who can view the workflow run, including anyone on a public repository, can read the leaked credentials, which persist until the run is deleted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams whose GitHub Actions builds use @zuke/core before 1.51.0 and place secret-derived text into report summaries. Runs outside GitHub Actions and builds that never summarize secret values are not affected. Public repositories are the highest-exposure case because anyone can view their run summaries.
No product ranges from the sources yet.
@zuke/core version in the project's Deno lock file or import map; versions below 1.51.0 are affected.reportSummary(...) calls in build code that include values from secret(...).reportSummary with secrets.@zuke/core fixed in 1.51.0; move to that version or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-119290")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.