Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.0 · zuke-buildNVD modified 2026-10-30 15:47
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 4
- https://github.com/zuke-build/zuke/security/advisories/GHSA-7h34-cmvx-hg95 x_refsource_confirm
- https://github.com/zuke-build/zuke/pull/542 x_refsource_misc
- https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654 x_refsource_misc
- https://github.com/zuke-build/zuke/releases/tag/core-v1.51.0 x_refsource_misc