TI-2026-83203 Aliases CVE-2026-119291

Symlink following in zuke setup and import allows outside writes

LOW 24CWE-59Published 2026-10-30 · Updated 2026-11-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zuke, a code-first build automation system for Deno, is affected before 1.4.0 in its @zuke/cli package. The zuke setup and zuke import commands check scaffold names with lstat but then follow symbolic links for reads, writes and permission changes (CWE-59). An attacker who supplies an untrusted cloned repository, template or archive with a symbolic link at a scaffolded name can overwrite a file outside the selected directory with the invoking user's permissions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00145 3rd percentileScored 2026-11-07

Fix Fixed zuke (zuke-build): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zuke-build	zuke	before 1.4.0	1.4.0	Patch available	CNA

zuke Vendorzuke-build Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

Remediation

Update zuke to version 1.4.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA zuke (zuke-build) Fixed in 1.4.0

Timeline

2026-10-30 Threatist record created from CVE-2026-119291
2026-11-01 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Other 4

TI-2026-83202 Zuke writes resolved secrets in cleartext to GitHub step summaries CVSS 3.1HIGH 7.5
TI-2026-83198 Zuke: Command-form registry descriptors bypass the MCP launch policy CVSS 3.1HIGH 8.0
TI-2026-83199 Argument injection in Zuke on Windows via cmd.exe batch shims CVSS 3.1HIGH 7.0
TI-2026-83201 Spoofable workflow run matching in Zuke githubWorkflow gate CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences