CVE-2026-1192897.1HighCWE-345

CVE-2026-119289: Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

zuke-build · zuke

Affected: zuke-build · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

7th percentile

050100

Higher than 7% of scored CVEs

7.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

zuke-build · zuke< 1.10.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Insufficient Verification of Data Authenticity · Cryptography
Vendor: zuke-build
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-119289 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.