CVE-2026-119287 in Zuke
Summary
by MITRE • 10/30/2026
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Zuke, specifically within versions prior to 1.51.0, represents a critical authorization bypass and privilege escalation flaw inherent to the design of its Model Context Protocol registry mode. As a code-first build automation system for Deno, Zuke relies on strict type safety and permission models to manage complex workflows. However, the core issue lies in how command-form registry descriptors are processed compared to remote module descriptors. While remote modules trigger the enforcement of the ZUKE_REGISTRY_LAUNCH_HOSTS authorization check, which restricts execution based on defined host permissions, this safeguard is entirely absent for command-form descriptors. This inconsistency creates a significant gap in the security boundary, allowing an attacker who can write to a registry accessible by the system to bypass intended access controls and execute arbitrary commands with elevated privileges.
From a technical perspective, the flaw exploits the distinction between how different descriptor types are validated during runtime. When a user invokes a tool via the command line using flags such as --registry and --allow-run, the system reads from the specified registry. If that registry is writable by an untrusted third party, that party can inject malicious entries in the form of command descriptors. Unlike module-based imports which undergo rigorous host validation, these command descriptors are executed directly without verifying if the target program or its arguments align with the operator's authorized launch hosts. Consequently, the attacker gains the ability to dictate exactly which executable is launched and what arguments it receives, effectively hijacking the execution context of the calling process.
The operational impact of this vulnerability is severe, as it leads to arbitrary code execution within the security context of the user running Zuke. Because the executed commands inherit the operator's environment variables and workspace access, an attacker can potentially exfiltrate sensitive data, modify project files, or pivot further into the network depending on the permissions granted to the developer account. The vulnerability is particularly insidious because standard mitigation mechanisms like --allow-run and protective name globs are rendered ineffective in this specific context. These safeguards rely on descriptors that supply explicit names for validation, but command-form registry descriptors bypass this mechanism by directly specifying execution parameters without triggering the same level of scrutiny applied to module imports.
Furthermore, the user interface elements associated with destructive actions do not provide adequate protection against this attack vector. The optional confirmation dialogues display descriptions controlled entirely by the registry writer rather than a standardized or system-verified message. This means that even if a user attempts to verify the action before proceeding, they may be misled into executing malicious commands under false pretenses, as the description presented is crafted by the attacker to appear benign or legitimate. The local default registry remains unaffected because it is populated exclusively through the zuke register command, which correctly writes module-form descriptors that are subject to proper validation checks, highlighting that this issue is isolated to externally managed registries using command-form entries.
To mitigate this risk, organizations must immediately upgrade Zuke to version 1.51.0 or later, where the authorization logic has been corrected to enforce host restrictions on all descriptor types regardless of their form. In environments where upgrading is not instantly feasible, strict access controls should be applied to any registry directories that are writable by untrusted parties. Developers should avoid using --allow-run with registries they do not fully trust and instead rely on the local default registry for internal tooling whenever possible. Additionally, auditing CI/CD pipelines and build scripts for references to external or shared registries is essential to prevent accidental exposure of this attack vector. This incident underscores the importance of consistent security policy enforcement across all input types in automation tools, ensuring that no descriptor format can circumvent core authorization checks.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-78 Improper Neutralization of Special Elements used in an OS Command, as it allows unauthorized actors to execute system commands by exploiting a failure in access control logic. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, where attackers use legitimate tools for unintended purposes due to misconfiguration or flaws in permission handling. The lack of proper validation on command arguments also touches upon CWE-787 Out-of-bounds Write if memory corruption were involved, but primarily it is an authorization bypass leading to remote code execution via trusted application abuse. Securing build automation systems requires rigorous input validation and consistent enforcement of security policies across all operational modes to prevent such privilege escalation paths from being exploited in production environments.