---
id: CVE-2026-119287
title: 'Zuke: Command-form registry descriptors bypass the MCP launch policy'
summary: >-
  Zuke is a code-first, strongly typed build automation system for Deno. Prior
  to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry
  descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization
  enforced for…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: zuke-build
product: zuke
affected:
  - zuke < 1.51.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T22:57:28.343811Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:57:38.406Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119287'
references:
  - url: 'https://github.com/zuke-build/zuke/security/advisories/GHSA-2rmh-5cw4-33gr'
    label: 'https://github.com/zuke-build/zuke/security/advisories/GHSA-2rmh-5cw4-33gr'
  - url: 'https://github.com/zuke-build/zuke/pull/542'
    label: 'https://github.com/zuke-build/zuke/pull/542'
  - url: >-
      https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
    label: >-
      https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
  - url: 'https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0'
    label: 'https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0'
tags:
  - cve.org
epss: 0.00223
epssPercentile: 0.12998
ingestedAt: '2026-11-05T21:36:00.667Z'
---

## Overview

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.

## Affected

- `zuke < 1.51.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.