CVE-2026-119290
Deferred Deferred - Pending Action

Secret Exposure in Zuke Build Automation System Summary

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119290
EUVD
EUVD-2026-114136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zuke-build zuke < 1.51.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Zuke, a build automation system for Deno. Before version 1.51.0, it writes secret values to GitHub Actions workflow run summaries without redacting them. This exposes credentials in cleartext to anyone viewing the workflow run, including unauthenticated users on public repositories.

Detection Guidance

Check if your Zuke version is below 1.51.0 by running deno info @zuke/core or checking package.json. Inspect GitHub Actions workflow runs for exposed secrets in GITHUB_STEP_SUMMARY files.

Impact Analysis

If you use Zuke versions before 1.51.0 and include secret-derived text in workflow summaries, your credentials could be leaked. This affects builds in GitHub Actions where secrets are summarized, potentially exposing sensitive data to unauthorized parties.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR and HIPAA requirements for protecting personal and health information. Unauthorized credential exposure may result in compliance breaches and legal consequences.

Mitigation Strategies

Upgrade Zuke to version 1.51.0 or later. Review all GitHub Actions workflows for secret-derived text in summary outputs and remove such content. Rotate any exposed credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart