VulnerabilityAnalyzed

CVE-2026-34041

act is a project which allows for local running of github actions.

HIGH 7.7EPSS 0.62%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

CVSS 4.0: 7.7 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.62% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-74
Affected: nektos/act
Source: security-advisories@github.com

References

https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097aPatch
https://github.com/nektos/act/releases/tag/v0.2.86Product
https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vwExploit, Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.