CVE-2026-119289
Deferred Deferred - Pending Action

Zuke GitHub Workflow Dispatch Validation Bypass

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119289
EUVD
EUVD-2026-114134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zuke-build zuke < 1.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Zuke, a build automation system for Deno. It allows an attacker to manipulate workflow runs by copying a display-title marker from a legitimate run. The gate system in versions before 1.10.0 incorrectly adopts the conclusion of a dispatched workflow run without verifying key details like the event, reference, or creation time. This can lead to unauthorized releases or blocked valid releases.

Impact Analysis

If you use Zuke for build automation, an attacker could exploit this to either push unauthorized releases or prevent legitimate ones. This could disrupt your build pipeline, compromise software integrity, or cause delays in deployment. The impact depends on whether the attacker can dispatch workflow runs in a repository you depend on.

Compliance Impact

This vulnerability could lead to unauthorized software releases, potentially violating integrity and access control requirements in GDPR and HIPAA. Unauthorized changes may result in non-compliance with data protection and security standards, especially if the affected software handles sensitive data.

Mitigation Strategies

Upgrade Zuke to version 1.10.0 or later to address the vulnerability in the githubWorkflow gate mechanism.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart