EUVD lists Windows shim argument reparsing flaw in Zuke before 1.51.0 (EUVD-2026-114133)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Zuke
- Product
- zuke
- First seen
Summary
A Mastodon post relaying an EUVD entry says Zuke versions before 1.51.0 launch resolved Windows .cmd and .bat shims through cmd /c, which can cause cmd.exe to reparse command lines. The entry gives a CVSS v3.1 score of 7.0/10.
If you use Zuke
Check whether your project uses zuke before 1.51.0 on Windows
Update zuke to 1.51.0 or later
Review the EUVD-2026-114133 entry for details
Check whether your project uses zuke before 1.10.0 with githubWorkflow gates
Update zuke to 1.10.0 or later
Review the EUVD-2026-114134 entry for details
What the sources say 4
· Mastodon: “Prior to 1.4.0, @ Zuke /cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supp...” Source
· Mastodon: “Prior to 1.51.0, @ Zuke /core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values ...” Source
· Mastodon: “Prior to 1.10.0, the @ Zuke /gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied ...” Source
· Mastodon: “Prior to 1.51.0, @ Zuke /core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build...” Source