# CVE-2026-119287: Zuke command-form registry descriptor authorization bypass

Source: https://junglewise.ai/threats/cve-2026-119287-zuke-is-a-code-first-strongly-typed-build-automation-system-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119287 · Severity: high · CVSS 8 · Published 2026-10-30

Zuke is a build automation system for Deno. When configured with MCP registry mode and --allow-run, a registry writable by another party can execute arbitrary commands with the operator's environment and workspace access, bypassing the host authorization policy that applies to remote module descriptors.

Technologies: [Zuke Build @Zuke/Core](https://junglewise.ai/threats/technologies/zuke-core). Vendors: [Zuke Build](https://junglewise.ai/threats/vendors/zuke-build).

## Quick answers

**Is CVE-2026-119287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119287 being exploited in the wild.

**How severe is CVE-2026-119287?** High severity, with a CVSS score of 8, published 30 October 2026.

**Which products and versions are affected?** Zuke Build @Zuke/Core before 1.51.0.

**Is there a fix for CVE-2026-119287?** Yes: fixed in 1.51.0. Until then: Restrict write access to shared registries to trusted parties only; do not use registry mode with --allow-run unless the registry is under your sole control.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"CVE-2026-119287 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119287 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119287?** Check whether you run Zuke Build @Zuke/Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.51.0

Restrict write access to shared registries to trusted parties only; do not use registry mode with --allow-run unless the registry is under your sole control.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"CVE-2026-119287 published"}]

## Technical details

The @zuke/core MCP registry mode fails to apply ZUKE_REGISTRY_LAUNCH_HOSTS authorization to command-form registry descriptors before version 1.51.0, allowing the registry writer to choose both the program and its arguments. An attacker with write access to a shared registry can craft a descriptor that runs any command when a run-capable caller invokes the tool, since the descriptor itself supplies the program name and arguments that bypass the --allow-run and --protect glob restrictions.

## Affected products

- Zuke Build @zuke/core before 1.51.0

## References

- [https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654](https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654)
- [https://github.com/zuke-build/zuke/pull/542](https://github.com/zuke-build/zuke/pull/542)

## Related threats

- [Zuke secrets exposure in GitHub Actions job summary](https://junglewise.ai/threats/cve-2026-119290-zuke-is-a-code-first-strongly-typed-build-automation-system-for)
- [Zuke command injection via batch file launching on Windows](https://junglewise.ai/threats/cve-2026-119288-zuke-is-a-code-first-strongly-typed-build-automation-system-for)