CVE-2026-119288

    Dashboard / Vulnerabilities / CVE-2026-119288

    CVE-2026-119288

    Published: 30 Oct 2026Last Modified: 1 Nov 2026

    Summary: Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

    Details: Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.

    References: https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119288.json, https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95, https://nvd.nist.gov/vuln/detail/CVE-2026-119288, https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654, https://github.com/zuke-build/zuke/pull/542

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a94c4b0795c5a1c7c7ecd7adc156c37264acfca4

    Affected versions

    core-v1.50.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119288 | CVE-DB