# CVE-2026-119290: Zuke secrets exposure in GitHub Actions job summary

Source: https://junglewise.ai/threats/cve-2026-119290-zuke-is-a-code-first-strongly-typed-build-automation-system-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119290 · Severity: high · CVSS 7.5 · Published 2026-10-30

Zuke is a build automation system for Deno that integrates with GitHub Actions. Prior to version 1.51.0, build summaries written to GitHub Actions failed to redact secret values, exposing credentials in cleartext to anyone viewing the workflow run, including the public if the repository is public. The exposure is permanent until the workflow run is deleted.

Technologies: [Zuke Build @Zuke/Core](https://junglewise.ai/threats/technologies/zuke-core). Vendors: [Zuke Build](https://junglewise.ai/threats/vendors/zuke-build).

## Quick answers

**Is CVE-2026-119290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119290 being exploited in the wild.

**How severe is CVE-2026-119290?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** Zuke Build @Zuke/Core before 1.51.0.

**Is there a fix for CVE-2026-119290?** Yes: fixed in 1.51.0. Until then: Avoid placing secret-derived values in build summary notes until upgrading to version 1.51.0. Runs outside GitHub Actions are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119290 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119290?** Check whether you run Zuke Build @Zuke/Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.51.0

Avoid placing secret-derived values in build summary notes until upgrading to version 1.51.0. Runs outside GitHub Actions are not affected.

## Technical details

Zuke's reportSummary() function writes job summaries to GitHub Actions' GITHUB_STEP_SUMMARY file via writeJobSummary() without applying the secret redactor that protects resolved secret() values everywhere else in the output. The vulnerability is specific to GitHub Actions integration and occurs when secret-derived text is included in summary notes. GitHub Actions masking directives do not protect the summary file, leaving credentials permanently visible until the run is deleted.

## Affected products

- Zuke Build @zuke/core before 1.51.0

## Timeline

- 2026-10-30: disclosed
- 2026-09-10: patched: Fixed in commit a46fd72 and PR #547

## References

- [https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7](https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7)
- [https://github.com/zuke-build/zuke/pull/547](https://github.com/zuke-build/zuke/pull/547)

## Related threats

- [Zuke command injection via batch file launching on Windows](https://junglewise.ai/threats/cve-2026-119288-zuke-is-a-code-first-strongly-typed-build-automation-system-for)
- [Zuke command-form registry descriptor authorization bypass](https://junglewise.ai/threats/cve-2026-119287-zuke-is-a-code-first-strongly-typed-build-automation-system-for)