CVE-2026-34041CRITICAL 9.8EPSS p44.9%

CVE-2026-34041CVE-2026-34041

Description

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.62% probability of exploitation · percentile 44.9% · 2026-06-19T12:03:05Z
Published2026-03-31
Last modified2026-04-06

Underlying weaknesses· 1

CWE-74

References

  1. https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a
  2. https://github.com/nektos/act/releases/tag/v0.2.86
  3. https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vw

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-740%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-34042
CVE
CVE-2026-26189
CVE
CVE-2025-54416
CVE
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
CVE
CVE-2026-33475
CVE
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.