PT-2026-28594 · Act · Act
Golang-Not-Rust
·
Publicado
2026-03-27
·
Atualizado
2026-04-07
·
CVE-2026-34041
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
act versions prior to 0.2.86
Description
act unconditionally processes the deprecated
::set-env:: and ::add-path:: workflow commands, which GitHub Actions disabled due to environment injection risks. When a workflow step echoes untrusted data to standard output, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This makes act less secure than GitHub Actions for the same workflow file. Exploitation can occur through malicious pull request titles, branch names, or commit messages if these are echoed to standard output. Successful exploitation can lead to command injection via environment variables like LD PRELOAD, NODE OPTIONS, PYTHONPATH, BASH ENV, and PERL5OPT, PATH hijacking, and cross-step escalation. The vulnerable code resides in pkg/runner/command.go, lines 52-58, where there is no check for the ACTIONS ALLOW UNSECURE COMMANDS environment variable.Recommendations
Update to act version 0.2.86 or later.
Exploit
Correção
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Act