PT-2026-29938 · Go · Github.Com/Nektos/Act

Published 2026-04-02 · Updated 2026-04-02

OSV

act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act

Related Identifiers

GO-2026-4891

Affected Products

Github.Com/Nektos/Act

References · 5

• https://osv.dev/vulnerability/GO-2026-4891 · Vendor Advisory
• https://github.com/nektos/act/security/advisories/GHSA-xmgr-9pqc-h5vw · Note
• https://github.com/nektos/act/commit/0c739c8e39c41aa5a07665f732da9cab6df0097a · Note
• https://github.com/nektos/act/releases/tag/v0.2.86 · Note
• https://github.com/advisories/GHSA-mfwh-5m23-j46w · Note