Back to overview

CVE-2026-34041

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

Metadata

CVE ID
CVE-2026-34041
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-03-25 15:29 UTC
Published
2026-03-31 01:43 UTC
Last updated
2026-04-02 14:49 UTC
Primary CWE
CWE-74
CWE-74: Improper Neutralization of Special Elements in Outpu…
Vendor / Product
nektos / act
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
nektos act — < 0.2.86
Weakness (CWE)
CWESourceDescription
CWE-74 cna CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (3)
Back to overview