Zuke's @zuke/core writes rendered reportSummary notes to the GitHub Actions job summary without applying the redaction used for resolved secret() values in console and run output. If a build places secret-derived text in a summary note, the credential is published in cleartext to everyone who can view the workflow run, including unauthenticated viewers of public repositories. The summary stays exposed until the run is deleted, and GitHub Actions masking does not protect it. Runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected.
zuke-build · Zuke (@zuke/core)
The githubWorkflow gate of the @zuke/gh package correlates an external GitHub Actions workflow run only by a title marker that is visible to anyone who can list runs and can be copied by another dispatcher. If the external workflow repository grants workflow_dispatch permission to a party the releasing repository does not fully trust, that party can dispatch a run with the marker and make the gate adopt its result without checking event, ref or creation time. A passing run can thereby authorize an unvalidated release, and a failed or cancelled run can block a valid one; the adopted run ID persists across build resume.
zuke-build · Zuke (@zuke/gh)
Zuke's @zuke/core package launches Windows .cmd and .bat tools through cmd /c, so cmd.exe re-parses the command line. If a build on Windows resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, | or ^, an additional attacker-chosen command runs in the build's context with access to its credentials. POSIX platforms are not affected.
zuke-build · Zuke
The @zuke/core MCP registry mode accepts command-form registry descriptors without applying the launch host authorization that is enforced for remote module descriptors. If a run-capable caller invokes the affected tool while zuke mcp --registry --allow-run reads a registry writable by a third party, the registry writer can choose the program and arguments that run with the operator's environment and workspace access. Exploitation requires write access to such a registry and a run-capable caller; the local default registry filled by zuke register is not affected.
zuke-build · zuke
