Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Affects Zuke builds under GitHub Actions that write secret()-derived values into summary notes, fixed in 1.51.0. No vendor rating is given; CVSS scores it 7.5 (high).
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 1.51.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Zuke, a Deno build automation system, is affected through its @zuke/core package, which can publish secret values in plain text into GitHub Actions job summaries. The impact is that credentials placed in build summary notes can be seen by anyone who can view the workflow run, including unauthenticated viewers of public repositories, and remain visible until the run is deleted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- zuke-build zuke
fixed in 1.51.0
References 4
GitHub · zuke-build/zuke
Questions about CVE-2026-119290
What does this mean?
When a Zuke build reports a summary note whose text comes from a secret() parameter, the resolved secret is written in plain text to GITHUB_STEP_SUMMARY. Anyone who can view the workflow run, including the saved job summary, can then read values such as deploy tokens, registry credentials or API keys.Source: github.com
Am I affected, and how do I check?
Versions of the zuke package (vendor zuke-build) before 1.51.0 are affected, and only when the build runs under GitHub Actions and a reportSummary() note derives from a secret() parameter. To check, look at the installed version of zuke or @zuke/core and search your build scripts for reportSummary calls that use secret() values.Source: github.com
What should I do about it?
Upgrade to @zuke/core 1.51.0, which is the fixed version. If you cannot upgrade yet, stop putting secret-derived values into reportSummary() notes and compose the note from non-secret parts or a fingerprint instead.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data