CVE-2026-119289

Full vulnerability record from the local CVENow database.

Description

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.

Severity

HIGH

CVSS score

7.1 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-30 16:17:43.013000

Last modified

2026-10-30 17:13:54.187000

View original CVE JSON

{
  "id": "CVE-2026-119289",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T16:17:43.013",
  "lastModified": "2026-10-30T17:13:54.187",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zuke-build",
          "product": "zuke",
          "versions": [
            {
              "version": "< 1.10.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.7
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zuke-build/zuke/pull/542",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zuke-build/zuke/releases/tag/gh-v1.10.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zuke-build/zuke/security/advisories/GHSA-rrc8-3g8p-cm8p",
      "source": "[email protected]"
    }
  ]
}