Executive Summary

CVE-2026-34041 is a high-severity vulnerability in the 'act' project, which allows running GitHub Actions workflows locally. Prior to version 0.2.86, 'act' unconditionally processed the deprecated GitHub Actions workflow commands ::set-env:: and ::add-path::. These commands were disabled in GitHub Actions due to environment injection risks.

The vulnerability occurs when a workflow step echoes untrusted data to stdout, allowing an attacker to inject these commands. This injection can set arbitrary environment variables or modify the PATH for all subsequent steps in the job, enabling environment variable injection and PATH hijacking.

This can lead to arbitrary code execution and command hijacking because malicious environment variables like LD_PRELOAD or NODE_OPTIONS can be set, and attacker-controlled binaries can be placed early in the PATH.

The issue was patched in version 0.2.86 by disabling these unsafe commands by default unless an environment variable ACTIONS_ALLOW_UNSECURE_COMMANDS is explicitly set to 'true', aligning with GitHub Actions' security model.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including arbitrary code execution on the system running 'act'. An attacker can inject malicious environment variables or modify the PATH, causing subsequent workflow steps to execute attacker-controlled code.

Specifically, attackers can exploit untrusted data echoed to stdout in workflow steps to inject commands that set environment variables such as LD_PRELOAD, NODE_OPTIONS, PYTHONPATH, BASH_ENV, or PERL5OPT, which can alter program behavior or load malicious code.

PATH hijacking allows attacker binaries to be executed instead of legitimate ones, escalating control over the workflow execution environment.

This also creates a supply chain risk where workflows that are safe on GitHub Actions become exploitable locally with 'act', potentially giving a false sense of security to developers and operators.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when the act tool processes the deprecated ::set-env:: and ::add-path:: workflow commands unconditionally, allowing environment variable and PATH injection if untrusted data is echoed to stdout.

To detect exploitation or presence of this vulnerability on your system, you can monitor workflow logs or outputs for unexpected occurrences of these deprecated commands, such as lines containing ::set-env:: or ::add-path::.

Since the vulnerability involves environment variable injection and PATH modification, you can also check your environment variables and PATH for unexpected or suspicious entries after running workflows with act versions prior to 0.2.86.

Specific commands to help detect this include:

• Search workflow logs or output files for the strings '::set-env::' or '::add-path::' using grep or similar tools, e.g., `grep -r '::set-env::' ./workflow-logs/`
• Check environment variables for unexpected entries, e.g., `env | grep EVIL_VAR` or other suspicious variable names.
• Inspect the PATH environment variable for unexpected directories, e.g., `echo $PATH` and look for suspicious paths like '/tmp/evil-bin'.

Note that the vulnerability is specific to act versions prior to 0.2.86, so verifying the version of act in use is also important.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade act to version 0.2.86 or later, where the vulnerability has been patched by disabling the unsafe processing of the deprecated ::set-env:: and ::add-path:: commands by default.

If upgrading is not immediately possible, you should ensure that the environment variable ACTIONS_ALLOW_UNSECURE_COMMANDS is not set to "true", as setting it to "true" explicitly enables the unsafe commands.

Additionally, you should review your workflows and avoid echoing untrusted data to stdout that could contain these deprecated commands.

The recommended best practice is to migrate workflows to use the safer Environment Files mechanism instead of the deprecated commands.

• Upgrade act to version 0.2.86 or later.
• Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable is unset or set to a value other than "true".
• Audit and sanitize workflow inputs to prevent injection of malicious commands.
• Migrate workflows to use Environment Files instead of ::set-env:: and ::add-path:: commands.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in act allows an attacker to inject arbitrary environment variables and modify the PATH during workflow execution, potentially leading to arbitrary code execution and command hijacking.

Such unauthorized code execution and environment manipulation can lead to unauthorized access, data breaches, or manipulation of sensitive data, which may violate compliance requirements under standards like GDPR and HIPAA that mandate protection of data integrity, confidentiality, and secure processing environments.

Because this vulnerability enables environment injection and code execution risks, organizations using affected versions of act without mitigation may face increased risk of non-compliance with these regulations due to potential exposure or compromise of protected data.

Useful 0 Not Useful 0