CVE-2026-119290 in Zuke
Summary
by MITRE • 10/30/2026
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Zuke versions prior to 1.51.0 represents a critical information disclosure flaw within the build automation system's reporting mechanism, specifically affecting GitHub Actions workflows that utilize secret-derived data for summary notes. As a code-first, strongly typed build tool designed for Deno, Zuke provides functionality to generate and write job summaries via the GITHUB_STEP_SUMMARY environment variable using the writeJobSummary function. The core technical flaw lies in the failure of this specific output path to apply the same redaction logic that is correctly implemented for console logs and persisted run outputs. While standard logging mechanisms properly mask sensitive values identified as secrets, preventing them from appearing in plain text within the build log interface, the summary generation process bypasses these security controls entirely. This inconsistency creates a significant gap in data protection where credentials or other sensitive information derived from secret inputs are rendered into the final report without any sanitization or masking applied to those specific fields.
The operational impact of this vulnerability is severe due to the persistent and potentially public nature of GitHub Actions summaries. Unlike transient console logs which may be obscured by platform-level masking directives, the content written to GITHUB_STEP_SUMMARY becomes part of a durable file associated with the workflow run. This summary remains visible for as long as the build artifacts are retained or until the specific run is manually deleted. Crucially, this exposure extends beyond internal team members; if the repository hosting the GitHub Actions workflow is public, anyone on the internet can view these summaries and extract cleartext credentials. Even in private repositories, all users with read access to the workflow runs gain visibility into sensitive data that was intended to remain confidential. This undermines the fundamental security principle of least privilege by exposing high-value assets such as API keys, tokens, or passwords to a broader audience than intended, potentially facilitating further unauthorized access or exploitation against downstream services where these credentials are used.
From a classification perspective, this vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the software, the operating system, the network, or other products, although in this context it is more accurately categorized under CWE-532, Information Exposure Through Log Files. The attack vector leverages ATT&CK technique T1530, Data from Cloud Storage Object, as attackers can harvest secrets directly from cloud-hosted build artifacts. Furthermore, the failure to properly handle sensitive data during output generation relates to CWE-798, Use of Hard-coded Credentials, if those credentials were inadvertently exposed through this channel. The root cause is a lack of consistent application of security controls across different I/O streams within the same toolset, highlighting the importance of ensuring that all code paths handling user-supplied or secret-derived data undergo uniform sanitization processes regardless of their destination format.
Mitigation for this vulnerability requires an immediate upgrade to Zuke version 1.51.0 or later, where the writeJobSummary function has been patched to correctly apply redaction logic to resolved secret values before writing them to the summary file. Organizations relying on older versions must treat any workflow runs that generated summaries containing sensitive data as compromised and rotate all affected credentials immediately. To prevent similar issues in custom build scripts or other automation tools, developers should ensure that any mechanism used for generating reports or logs explicitly checks for and masks secret values using established cryptographic hashing or masking libraries rather than relying on implicit platform behaviors which may vary between different output formats. Regular auditing of CI/CD pipeline outputs is also recommended to detect accidental exposure of sensitive data in build artifacts before they can be exploited by malicious actors monitoring public repositories or unauthorized internal users.