zuke-build zuke

• CVE-2026-119291 Medium 5.5 zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory 0.1%
• CVE-2026-119290 High 7.5 Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run 0.5%
• CVE-2026-119289 High 7.1 Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate 0.2%
• CVE-2026-119288 High 7.0 Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line 0.2%
• CVE-2026-119287 High 8.0 Zuke: Command-form registry descriptors bypass the MCP launch policy 0.2%