MEDIUM 5.5 NVD
CVE-2026-119291
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-fol
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.
References
- https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
- https://github.com/zuke-build/zuke/pull/542
- https://github.com/zuke-build/zuke/releases/tag/cli-v1.4.0
- https://github.com/zuke-build/zuke/security/advisories/GHSA-hc8w-3fgv-22pw
This medium severity vulnerability with a CVSS score of 5.5 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.