CVE-2026-119288

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.

• CWE-78

• https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
• https://github.com/zuke-build/zuke/pull/542
• https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0
• https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119282Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-119283joserfc is a Python library that provides an implementation …7.5
• CVE-2026-119284joserfc is a Python library that provides an implementation …6.9
• CVE-2026-119285Fiber is an Express inspired web framework written in Go. Fr…5.9
• CVE-2026-119286GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-119287Zuke is a code-first, strongly typed build automation system…8
• CVE-2026-119289Zuke is a code-first, strongly typed build automation system…7.1
• CVE-2026-11929IBM Security Verify Identity Access Reverse Proxy in certain…7.5
• CVE-2026-119290Zuke is a code-first, strongly typed build automation system…7.5
• CVE-2026-119291Zuke is a code-first, strongly typed build automation system…5.5
• CVE-2026-119298croc is a tool that allows any two computers to simply and s…4.2
• CVE-2026-119299gopacket provides packet processing capabilities for Go. Pri…5.9