Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-119290Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

High 7.5

In plain English

A high-severity sensitive data in logs in zuke from zuke-build. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

Affected products (as reported)

Vendor	Product	Versions
zuke-build	zuke	< 1.51.0

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23 x_refsource_CONFIRM
https://github.com/zuke-build/zuke/pull/547 x_refsource_MISC
https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7 x_refsource_MISC
https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 x_refsource_MISC