CVE-2026-119287

Zuke MCP registry commands bypass execution policy

zuke-build · @zuke/core MCP registry

First documented disclosure · Review checkpoint

Summary

A writer to a shared build registry can choose commands run by the MCP host.

Severity and exploitation evidence

High · 8.0/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Command-form registry descriptors were allowed before the remote-module launch policy was checked; tool names and confirmation descriptions were also supplied by the registry writer.

Conditions required

The server uses registry mode with --allow-run, another party can write the registry, and a run-capable caller invokes the affected tool. The local default registry populated only by zuke register is not affected.

Potential impact

Commands execute as the operator in the workspace and can access inherited environment credentials, subject to process permissions.

Affected versions and configurations

@zuke/core before 1.51.0, in the affected shared-registry execution configuration.

Fix and mitigation status

1.51.0 fixes this issue; it is not an overall security assurance for an old release.

Practical next steps

Use a supported release containing the fix, disable registry execution or restrict registry writers. Review the new exact program allowlist; approving an interpreter also trusts the arguments the registry supplies.

Operating lesson

Authorize the concrete executable and registry writer, not a tool name chosen by that writer.

Evidence and limits

Public issue #536 and the advisory date to September 10; CVE publication was October 30. The fix adds ZUKE_REGISTRY_LAUNCH_COMMANDS; its residual interpreter and relative-path risks are documented.

Sources