---
id: "CVE-2026-119290"
kind: "vulnerability"
aliases: ["CVE-2026-119290"]
title: "Zuke: build summaries can publish secrets in cleartext to workflow runs"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "deno", "github-actions", "package", "zuke"]
not_affected_if: ["no-secrets-in-summaries", "non-github-actions", "version-1.51.0-or-later"]
published_at: "2026-10-30T16:17:43+00:00"
first_seen_at: "2026-10-30T16:31:25+00:00"
updated_at: "2026-10-30T16:32:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119290", "first_seen_at": "2026-10-30T16:31:25+00:00"}]
---

# Zuke: build summaries can publish secrets in cleartext to workflow runs

Zuke, a Deno build automation library, writes rendered report notes to the GitHub Actions job summary without redacting secret values. An attacker who can view the workflow run, including anyone on a public repository, can read the leaked credentials, which persist until the run is deleted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `@zuke/core` version in the project's Deno lock file or import map; versions below `1.51.0` are affected.
- Look for `reportSummary(...)` calls in build code that include values from `secret(...)`.
- Review past GitHub Actions run summaries for secret-derived text if the build used `reportSummary` with secrets.

## Fix

- `@zuke/core` fixed in `1.51.0`; move to that version or later.

## Timeline

- 2026-10-30T16:31:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119290

## From the sources

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_