Environment Injection Vulnerability in act by nektos
CVE-2026-34041

7.7HIGH

Key Information:

Vendor

Nektos

Status
Act
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34041?

The act project, which facilitates the local execution of GitHub Actions, has a vulnerability related to the handling of certain workflow commands. Versions prior to 0.2.86 improperly process the deprecated ::set-env:: and ::add-path:: commands, posing a risk of environment injection. If a workflow step outputs untrusted data, an attacker could exploit this by injecting malicious commands, allowing for the alteration of environment variables or modification of the PATH for subsequent steps in the pipeline. This presents a significant risk in automated workflows. The issue has been resolved in version 0.2.86.

Affected Version(s)

act < 0.2.86

References

https://github.com/nektos/act/security/advisories/GHSA-xm...
x_refsource_CONFIRM
https://github.com/nektos/act/commit/0c739c8e39c41aa5a076...
x_refsource_MISC
https://github.com/nektos/act/releases/tag/v0.2.86
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.