Live › vulnerability › CVE-2026-119291
Zuke is a Deno build automation tool whose CLI checks scaffold names with lstat but then follows symbolic links when reading, writing and changing permissions during zuke setup and zuke import. A malicious cloned repository, template or archive containing a symlink can make the tool overwrite files outside the chosen directory and read link-target content into a generated build file, with the invoking user's permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that run the Zuke CLI (@zuke/cli) before version 1.4.0 on repositories, templates or archives they did not write. Exposure comes from running setup or import on untrusted input; projects that only use Zuke on code they control are less exposed. Teams that do not use Zuke can skip it.
No product ranges from the sources yet.
@zuke/cli and which version is installed, for example with deno info or the lockfile.zuke setup or zuke import has been run against untrusted repositories, templates or archives.@zuke/cli: move to 1.4.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-119291")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.