Zuke writes resolved secrets in cleartext to GitHub step summaries
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Zuke before 1.51.0 writes rendered reportSummary notes to GITHUB_STEP_SUMMARY without redacting resolved secret() values (CWE-532). A build that places secret-derived text in a summary note publishes those credentials in cleartext to anyone who can view the workflow run, including unauthenticated viewers of a public repository. The summary stays exposed until the run is deleted.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zuke-build | zuke | before 1.51.0 | 1.51.0 | Patch available | CNA |
- zuke Vendorzuke-build Affected before 1.51.0 Fixed in 1.51.0 Patch available CNA
Remediation
Upgrade zuke to version 1.51.0, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA zuke (zuke-build) Fixed in 1.51.0
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119290
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
More zuke-build vulnerabilities
- TI-2026-83198 Zuke: Command-form registry descriptors bypass the MCP launch policy CVSS 3.1HIGH 8.0
- TI-2026-83199 Argument injection in Zuke on Windows via cmd.exe batch shims CVSS 3.1HIGH 7.0
- TI-2026-83201 Spoofable workflow run matching in Zuke githubWorkflow gate CVSS 3.1HIGH 7.1
- TI-2026-83203 Symlink following in zuke setup and import allows outside writes CVSS 3.1MEDIUM 5.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences