Advisories · Technology
zuke.
Every CVE that names zuke among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.5 Medium
zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory
- zuke
- Path traversal
- CVSS 7.5 High
Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
- zuke
- Information disclosure
- CVSS 7.1 High
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
- zuke
- CWE-345
- CVSS 7.0 High
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
- zuke
- Command injection
- CVSS 8.0 High
Zuke: Command-form registry descriptors bypass the MCP launch policy
- zuke
- Broken access control