CVE-2026-34041

HIGH EPSS 45.1%
Published Mar 31, 20263mo ago · Modified Jun 17, 20262w ago
7.7 CVSS 4.0
High
Find Similar
Published Mar 31, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
45.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-74

Affected Products 1

VendorProductVersionRange
nektosact* <0.2.86

References 3

  • github.com https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a
    Patch
  • github.com https://github.com/nektos/act/releases/tag/v0.2.86
    Product
  • github.com https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vw
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a
    Patch