CVE-2026-34041highCWE-74

CVE-2026-34041: falha de alta gravidade em nektos act

act: Unrestricted set-env and add-path command processing enables environment injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar act+ Monitorar github.com/nektos/act

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.6%
act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nektos · act
CVEs relacionadas — nektos act

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22726HIGHUnrestricted file upload leading to privilege escalation in actEPSS 1.3%CVE-2026-34042HIGHact: actions/cache server allows malicious cache injectionEPSS 0.5%CVE-2026-76847HIGHact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 BackendEPSS 0.4%