VYPR
Get started
← All advisories
Critical severity9.8NVD Advisory· Published Mar 31, 2026· Updated Apr 6, 2026

CVE-2026-34041

CVE-2026-34041

Description

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/nektos/actGo
< 0.2.860.2.86

Affected products

1
  • Nektos/Act
    cpe:2.3:a:nektos:act:*:*:*:*:*:*:*:*
    Range: <0.2.86

Patches

1
0c739c8e39c4

Merge commit from fork

https://github.com/nektos/actgolang-not-rustMar 25, 2026via ghsa
commit
4 files changed · +35 −0
  • pkg/runner/command.go+8 −0 modified
    @@ -51,10 +51,18 @@ func (rc *RunContext) commandHandler(ctx context.Context) common.LineHandler {
 		defCommandLogger := logger.WithFields(logrus.Fields{"command": command, "kvPairs": kvPairs, "arg": arg, "raw": line})
 		switch command {
 		case "set-env":
+			if rc.Env["ACTIONS_ALLOW_UNSECURE_COMMANDS"] != "true" {
+				defCommandLogger.Errorf("The `set-env` command is disabled. Please upgrade to using Environment Files or opt into unsafe commands by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`.")
+				break
+			}
 			rc.setEnv(ctx, kvPairs, arg)
 		case "set-output":
 			rc.setOutput(ctx, kvPairs, arg)
 		case "add-path":
+			if rc.Env["ACTIONS_ALLOW_UNSECURE_COMMANDS"] != "true" {
+				defCommandLogger.Errorf("The `add-path` command is disabled. Please upgrade to using Environment Files or opt into unsafe commands by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`.")
+				break
+			}
 			rc.addPath(ctx, arg)
 		case "debug":
 			defCommandLogger.Debugf("  \U0001F4AC  %s", line)
  • pkg/runner/command_test.go+24 −0 modified
    @@ -18,12 +18,23 @@ func TestSetEnv(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()
 	rc := new(RunContext)
+	rc.Env = map[string]string{"ACTIONS_ALLOW_UNSECURE_COMMANDS": "true"}
 	handler := rc.commandHandler(ctx)
 
 	handler("::set-env name=x::valz\n")
 	a.Equal("valz", rc.Env["x"])
 }
 
+func TestSetEnvBlocked(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("::set-env name=x::valz\n")
+	a.Equal("", rc.Env["x"])
+}
+
 func TestSetOutput(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()
@@ -58,6 +69,7 @@ func TestAddpath(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()
 	rc := new(RunContext)
+	rc.Env = map[string]string{"ACTIONS_ALLOW_UNSECURE_COMMANDS": "true"}
 	handler := rc.commandHandler(ctx)
 
 	handler("::add-path::/zoo\n")
@@ -67,12 +79,23 @@ func TestAddpath(t *testing.T) {
 	a.Equal("/boo", rc.ExtraPath[0])
 }
 
+func TestAddPathBlocked(t *testing.T) {
+	a := assert.New(t)
+	ctx := context.Background()
+	rc := new(RunContext)
+	handler := rc.commandHandler(ctx)
+
+	handler("::add-path::/zoo\n")
+	a.Empty(rc.ExtraPath)
+}
+
 func TestStopCommands(t *testing.T) {
 	logger, hook := test.NewNullLogger()
 
 	a := assert.New(t)
 	ctx := common.WithLogger(context.Background(), logger)
 	rc := new(RunContext)
+	rc.Env = map[string]string{"ACTIONS_ALLOW_UNSECURE_COMMANDS": "true"}
 	handler := rc.commandHandler(ctx)
 
 	handler("::set-env name=x::valz\n")
@@ -96,6 +119,7 @@ func TestAddpathADO(t *testing.T) {
 	a := assert.New(t)
 	ctx := context.Background()
 	rc := new(RunContext)
+	rc.Env = map[string]string{"ACTIONS_ALLOW_UNSECURE_COMMANDS": "true"}
 	handler := rc.commandHandler(ctx)
 
 	handler("##[add-path]/zoo\n")
  • pkg/runner/testdata/commands/push.yml+2 −0 modified
    @@ -4,6 +4,8 @@ on: push
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: "true"
     steps:
       - name: TEST set-env
         run: echo "::set-env name=foo::bar"
  • pkg/runner/testdata/GITHUB_ENV-use-in-env-ctx/push.yml+1 −0 modified
    @@ -4,6 +4,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       MYGLOBALENV3: myglobalval3
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: "true"
     steps:
     - run: |
         echo MYGLOBALENV1=myglobalval1 > $GITHUB_ENV

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.