CVE-2026-119290

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

• CWE-532

• https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7
• https://github.com/zuke-build/zuke/pull/547
• https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0
• https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119285Fiber is an Express inspired web framework written in Go. Fr…5.9
• CVE-2026-119286GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-119287Zuke is a code-first, strongly typed build automation system…8
• CVE-2026-119288Zuke is a code-first, strongly typed build automation system…7
• CVE-2026-119289Zuke is a code-first, strongly typed build automation system…7.1
• CVE-2026-11929IBM Security Verify Identity Access Reverse Proxy in certain…7.5
• CVE-2026-119291Zuke is a code-first, strongly typed build automation system…5.5
• CVE-2026-119298croc is a tool that allows any two computers to simply and s…4.2
• CVE-2026-119299gopacket provides packet processing capabilities for Go. Pri…5.9
• CVE-2026-1193A vulnerability was identified in MineAdmin 1.x/2.x. The imp…8.8
• CVE-2026-11930IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5
• CVE-2026-119300Wekan is open source kanban built with Meteor. Prior to 11.1…6.5