Is CVE-2026-119288 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119288 being exploited in the wild.

How severe is CVE-2026-119288?

High severity, with a CVSS score of 7, published 30 October 2026.

Which products and versions are affected?

Zuke Build @Zuke/Core before 1.51.0.

Is there a fix for CVE-2026-119288?

Yes: fixed in 1.51.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119288 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-119288?

Check whether you run Zuke Build @Zuke/Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119288: Zuke command injection via batch file launching on Windows

CVE-2026-119288 · Severity: high · CVSS 7 · Published 2026-10-30

Zuke is a build automation system for Deno that runs build tasks on developer machines. On Windows, Zuke versions before 1.51.0 can be tricked into executing arbitrary commands if a build task receives untrusted input containing special characters. An attacker could exploit this by crafting malicious input to a build that uses tools from node_modules, potentially gaining access to build credentials and environment secrets.

Technologies: Zuke Build @Zuke/Core. Vendors: Zuke Build.

Quick answers

Is CVE-2026-119288 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119288 being exploited in the wild.
How severe is CVE-2026-119288?: High severity, with a CVSS score of 7, published 30 October 2026.
Which products and versions are affected?: Zuke Build @Zuke/Core before 1.51.0.
Is there a fix for CVE-2026-119288?: Yes: fixed in 1.51.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119288 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-119288?: Check whether you run Zuke Build @Zuke/Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.51.0

Technical details

The vulnerability is a command injection flaw in how @zuke/core launches Windows .cmd and .bat files. The code prepends "cmd /c" to the command line, but cmd.exe re-parses the arguments using C-runtime quoting rules, which leave &, |, and ^ metacharacters unquoted and thus interpreted as shell operators. An attacker-controlled string passed to a build tool resolved from node_modules can inject additional commands. This affects Windows only; POSIX platforms are not vulnerable.

Affected products

Zuke Build @zuke/core before 1.51.0

Timeline

2026-09-10: patched: Fix merged in commit 4257b0bc5ef7a44f913349646d4baccd1654
2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.