Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34041act: Unrestricted set-env and add-path command processing enables environment injection

Critical 9.8

In plain English

A critical-severity injection in act from nektos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 49.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/nektos/act	0.2.86	GHSA-xmgr-9pqc-h5vw
Go	github.com/nektos/act	0.2.86	GO-2026-4891

Affected products (as reported)

Vendor	Product	Versions
nektos	act	< 0.2.86

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vw x_refsource_CONFIRM
https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a x_refsource_MISC
https://github.com/nektos/act/releases/tag/v0.2.86 x_refsource_MISC