{"id":"CVE-2026-119290","kind":"vulnerability","aliases":["CVE-2026-119290"],"related":[],"title":"Zuke: build summaries can publish secrets in cleartext to workflow runs","description":"Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.","summary":"Zuke, a Deno build automation library, writes rendered report notes to the GitHub Actions job summary without redacting secret values. An attacker who can view the workflow run, including anyone on a public repository, can read the leaked credentials, which persist until the run is deleted.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","deno","github-actions","package","zuke"],"not_affected_if":["no-secrets-in-summaries","non-github-actions","version-1.51.0-or-later"],"how_to_check":"- Check the installed `@zuke/core` version in the project's Deno lock file or import map; versions below `1.51.0` are affected.\n- Look for `reportSummary(...)` calls in build code that include values from `secret(...)`.\n- Review past GitHub Actions run summaries for secret-derived text if the build used `reportSummary` with secrets.","fix":"- `@zuke/core` fixed in `1.51.0`; move to that version or later.","status":"open","published_at":"2026-10-30T16:17:43+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:02+00:00","updated_at":"2026-10-30T16:32:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T16:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- `@zuke/core` fixed in `1.51.0`; move to that version or later.","reach":"internet","title":"Zuke: build summaries can publish secrets in cleartext to workflow runs","impact":"high","summary":"Zuke, a Deno build automation library, writes rendered report notes to the GitHub Actions job summary without redacting secret values. An attacker who can view the workflow run, including anyone on a public repository, can read the leaked credentials, which persist until the run is deleted.","audience":"developers","category":"package","nicknames":[],"who_cares":["deno","github-actions","zuke","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Secrets readable in cleartext by anyone who can view the run","analyst_note":"","how_to_check":"- Check the installed `@zuke/core` version in the project's Deno lock file or import map; versions below `1.51.0` are affected.\n- Look for `reportSummary(...)` calls in build code that include values from `secret(...)`.\n- Review past GitHub Actions run summaries for secret-derived text if the build used `reportSummary` with secrets.","plain_action":"","needs_analyst":false,"not_affected_if":["no-secrets-in-summaries","non-github-actions","version-1.51.0-or-later"],"who_is_affected":"Teams whose GitHub Actions builds use @zuke/core before 1.51.0 and place secret-derived text into report summaries. Runs outside GitHub Actions and builds that never summarize secret values are not affected. Public repositories are the highest-exposure case because anyone can view their run summaries.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4266,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119290':14A,17A '-2026':13A,16A '1.51.0':86C,192C 'abl':134C 'action':22B,38B,115C,159C,172C 'affect':185C 'anyon':54B 'appli':99C 'attack':46B 'autom':29B,80C 'build':2A,28B,79C,116C,174C 'ci':18B 'cleartext':8A,131C 'code':75C 'code-first':74C 'consol':108C 'credenti':63B,129C 'cve':12A,15A 'delet':70B,157C 'deno':19B,27B,83C 'deriv':121C,181C 'direct':161C 'durabl':149C 'everyon':133C 'expos':152C 'file':167C 'first':76C 'fix':189C 'github':21B,37B,93C,114C,158C,171C 'github-act':20B 'includ':53B,140C 'issu':187C 'job':39B 'leak':62B 'librari':30B 'mask':160C 'note':34B,91C,126C 'output':112C 'outsid':170C 'packag':23B 'persist':65B,110C 'place':118C 'prior':84C 'protect':103C,164C 'public':57B,145C 'publish':5A,128C 'read':60B 'redact':42B 'redactor':101C 'remain':151C 'render':32B,89C 'report':33B 'reportsummari':90C 'repositori':58B,146C 'resolv':104C 'run':11A,52B,68B,111C,139C,155C,169C 'secret':6A,43B,105C,120C,180C 'secret-deriv':119C,179C 'step':94C 'strong':77C 'summar':178C 'summari':3A,40B,95C,125C,150C,166C 'system':81C 'text':122C,182C 'type':78C 'unauthent':141C 'valu':44B,106C 'version':191C 'view':49B,136C 'viewer':142C 'without':41B,98C 'workflow':10A,51B,138C 'write':31B,88C 'writejobsummari':97C 'zuke':1A,24B,25B,71C 'zuke/core':87C","nicknames":[],"mitigations":[],"who_affected":"Teams whose GitHub Actions builds use @zuke/core before 1.51.0 and place secret-derived text into report summaries. Runs outside GitHub Actions and builds that never summarize secret values are not affected. Public repositories are the highest-exposure case because anyone can view their run summaries.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119290","severity":null,"published_at":"2026-10-30T16:17:43+00:00","modified_at":"2026-10-30T16:17:43+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}