---
id: CVE-2026-119288
title: >-
  Zuke: Argument injection on Windows: batch shims are launched through cmd.exe,
  which re-parses the command line
summary: >-
  Zuke is a code-first, strongly typed build automation system for Deno. Prior
  to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by
  prepending cmd /c, causing cmd.exe to reparse a command line assembled with
  C-runtime quo…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: zuke-build
product: zuke
affected:
  - zuke < 1.51.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T18:25:54.186155Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:36:00.991Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119288'
references:
  - url: 'https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95'
    label: 'https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95'
  - url: 'https://github.com/zuke-build/zuke/pull/542'
    label: 'https://github.com/zuke-build/zuke/pull/542'
  - url: >-
      https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
    label: >-
      https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654
  - url: 'https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0'
    label: 'https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0'
tags:
  - cve.org
epss: 0.00186
epssPercentile: 0.08344
ingestedAt: '2026-11-05T16:24:31.336Z'
---

## Overview

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.

## Affected

- `zuke < 1.51.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.