zuke
- Software type
- Other
- Total vulnerabilities (90 days)
- 5
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/30/2026, zuke recorded 5 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of zuke and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-119291zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryCVE-2026-119290Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runCVE-2026-119289Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gateCVE-2026-119288Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command lineCVE-2026-119287Zuke: Command-form registry descriptors bypass the MCP launch policy5 Results | Page 1 of 1