CVE-2026-119290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119290", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.065Z", "datePublished": "2026-10-30T15:50:46.959Z", "dateUpdated": "2026-10-30T16:38:54.900Z"}, "containers": {"cna": {"title": "Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23"}, {"name": "https://github.com/zuke-build/zuke/pull/547", "tags": ["x_refsource_MISC"], "url": "https://github.com/zuke-build/zuke/pull/547"}, {"name": "https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7", "tags": ["x_refsource_MISC"], "url": "https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7"}, {"name": "https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0"}], "affected": [{"vendor": "zuke-build", "product": "zuke", "versions": [{"version": "< 1.51.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T15:50:46.959Z"}, "descriptions": [{"lang": "en", "value": "Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0."}], "source": {"advisory": "GHSA-42wp-rrh6-vc23", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:38:41.243763Z", "id": "CVE-2026-119290", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:38:54.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:38:41.243763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:38:50.359Z"}}], "cna": {"title": "Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run", "source": {"advisory": "GHSA-42wp-rrh6-vc23", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zuke-build", "product": "zuke", "versions": [{"status": "affected", "version": "< 1.51.0"}]}], "references": [{"url": "https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23", "name": "https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zuke-build/zuke/pull/547", "name": "https://github.com/zuke-build/zuke/pull/547", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7", "name": "https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0", "name": "https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T15:50:46.959Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119290", "state": "PUBLISHED", "dateUpdated": "2026-10-30T16:38:54.900Z", "dateReserved": "2026-10-29T18:50:28.065Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-30T15:50:46.959Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zuke", "vendor": "zuke-build", "versions": [{"status": "affected", "version": "< 1.51.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0."}], "id": "CVE-2026-119290", "lastModified": "2026-10-30T17:17:17.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119290", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:38:41.243763Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:43.160", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7"}, {"source": "security-advisories@github.com", "url": "https://github.com/zuke-build/zuke/pull/547"}, {"source": "security-advisories@github.com", "url": "https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.51.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zuke", "source": "cna", "vendor": "zuke-build"}, "product": "zuke", "vendor": "zuke-build"}], "created": "2026-10-30T17:45:15.025887+00:00", "updated": "2026-10-30T22:49:50.556708+00:00", "vendors": ["zuke-build", "zuke-build$PRODUCT$zuke"]}