CVE-2026-34041CWE-74

act: Unrestricted set-env and add-path command processing enables environment injection

High · published March 31, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00742 · 54.1th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-03-31T01:43Z
EPSS history
Timeline
  • 31 MAR 01:43Z
    act: Unrestricted set-env and add-path command processing enables environment injection
    cvelistv5