Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…d/zuke/security/advisories/GHSA-7h34-cmvx-hg95 Diğer
• github.com/zuke-build/zuke/pull/542 Diğer
• github.com/…ommit/4257b0bc5ef5e387a44f913349646d4baccd1654 Diğer
• github.com/zuke-build/zuke/releases/tag/core-v1.51.0 Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:47Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-119291zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory
• 7,5 CVE-2026-119290Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
• 7,1 CVE-2026-119289Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
• 8,0 CVE-2026-119287Zuke: Command-form registry descriptors bypass the MCP launch policy
• 8,8 CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
• 7,2 CVE-2026-118238CVE-2026-118238