{"id":"CVE-2026-119291","aliases":[],"cve":{"records":[{"id":"CVE-2026-119291","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.065Z","published":"2026-10-30T15:52:01.029Z","modified":"2026-10-30T15:52:01.029Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T15:52:01.029Z"}],"references":[{"url":"https://github.com/zuke-build/zuke/security/advisories/GHSA-hc8w-3fgv-22pw","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/zuke-build/zuke/pull/542","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/zuke-build/zuke/releases/tag/cli-v1.4.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-59","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.","score":5.5,"severity":"medium","published":"2026-10-30T15:52:01.029Z","modified":"2026-10-30T15:52:01.029Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zuke-build","name":"zuke","platforms":[],"versions":[{"version":"< 1.4.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119291"}],"remediation":[],"references":["https://github.com/zuke-build/zuke/security/advisories/GHSA-hc8w-3fgv-22pw","https://github.com/zuke-build/zuke/pull/542","https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654","https://github.com/zuke-build/zuke/releases/tag/cli-v1.4.0"],"sources":[{"name":"CVE","id":"CVE-2026-119291","modified":"2026-10-30T15:52:01.029Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119291"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.5}],"sourceAffected":[],"observedAt":"2026-10-30T17:20:01.376Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:55:30.958Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}