CVE-2026-34041 Details
Description
act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.
A vulnerability in Nektos act, a tool for running GitHub Actions locally, allows for environment and path injection. This issue exists in versions through 0.2.85. The vulnerability arises because act processes the deprecated '::set-env::' and '::add-path::' commands without any checks. These commands can be exploited to set arbitrary environment variables or modify the PATH for subsequent steps in a workflow. The problem is particularly concerning because it creates a false sense of security; workflows that are safe on GitHub Actions can become vulnerable when run with act.
Users can upgrade to act version 0.2.86, which patches this vulnerability by adding the necessary checks for the '::set-env::' and '::add-path::' commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a | [email protected] | Patch |
| https://github.com/nektos/act/releases/tag/v0.2.86 | [email protected] | Product |
| https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vw | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nektos act | < 0.2.86 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |