# CVE-2026-119288: Zuke command injection via batch file launching on Windows

Source: https://junglewise.ai/threats/cve-2026-119288-zuke-is-a-code-first-strongly-typed-build-automation-system-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119288 · Severity: high · CVSS 7 · Published 2026-10-30

Zuke is a build automation system for Deno that runs build tasks on developer machines. On Windows, Zuke versions before 1.51.0 can be tricked into executing arbitrary commands if a build task receives untrusted input containing special characters. An attacker could exploit this by crafting malicious input to a build that uses tools from node_modules, potentially gaining access to build credentials and environment secrets.

Technologies: [Zuke Build @Zuke/Core](https://junglewise.ai/threats/technologies/zuke-core). Vendors: [Zuke Build](https://junglewise.ai/threats/vendors/zuke-build).

## Quick answers

**Is CVE-2026-119288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119288 being exploited in the wild.

**How severe is CVE-2026-119288?** High severity, with a CVSS score of 7, published 30 October 2026.

**Which products and versions are affected?** Zuke Build @Zuke/Core before 1.51.0.

**Is there a fix for CVE-2026-119288?** Yes: fixed in 1.51.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119288 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-119288?** Check whether you run Zuke Build @Zuke/Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.51.0

## Technical details

The vulnerability is a command injection flaw in how @zuke/core launches Windows .cmd and .bat files. The code prepends "cmd /c" to the command line, but cmd.exe re-parses the arguments using C-runtime quoting rules, which leave &, |, and ^ metacharacters unquoted and thus interpreted as shell operators. An attacker-controlled string passed to a build tool resolved from node_modules can inject additional commands. This affects Windows only; POSIX platforms are not vulnerable.

## Affected products

- Zuke Build @zuke/core before 1.51.0

## Timeline

- 2026-09-10: patched: Fix merged in commit 4257b0bc5ef7a44f913349646d4baccd1654
- 2026-10-30: disclosed

## References

- [https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654](https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654)
- [https://github.com/zuke-build/zuke/pull/542](https://github.com/zuke-build/zuke/pull/542)

## Related threats

- [Zuke secrets exposure in GitHub Actions job summary](https://junglewise.ai/threats/cve-2026-119290-zuke-is-a-code-first-strongly-typed-build-automation-system-for)
- [Zuke command-form registry descriptor authorization bypass](https://junglewise.ai/threats/cve-2026-119287-zuke-is-a-code-first-strongly-typed-build-automation-system-for)