CVE-2026-34041: GitHub Actions Runner (act) RCE Vulnerability

CVE-2026-34041 Overview

CVE-2026-34041 is an environment injection vulnerability affecting act, a popular open-source project that enables local execution of GitHub Actions workflows. Prior to version 0.2.86, the application unconditionally processes deprecated ::set-env:: and ::add-path:: workflow commands that were disabled in the official GitHub Actions runner due to known environment injection risks.

When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This can lead to arbitrary code execution, credential theft, or supply chain compromise in CI/CD pipelines.

Critical Impact

Attackers can inject malicious environment variables and PATH modifications through untrusted workflow data, potentially compromising the entire CI/CD pipeline and enabling arbitrary code execution.

Affected Products

• nektos/act versions prior to 0.2.86
• Local GitHub Actions runners using vulnerable act versions
• CI/CD pipelines leveraging act for local workflow testing

Discovery Timeline

• 2026-03-31 - CVE-2026-34041 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34041

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly referred to as an injection vulnerability. The root issue stems from act's processing of deprecated GitHub Actions workflow commands that were intentionally disabled in the official runner due to security concerns.

GitHub Actions originally supported ::set-env:: and ::add-path:: commands that allowed workflows to dynamically set environment variables and modify the PATH. These commands were deprecated and disabled in November 2020 due to the inherent risk of environment injection when workflows process untrusted input. However, the act project continued to process these commands unconditionally.

The vulnerability can be exploited through network-accessible vectors when untrusted data flows through workflow steps. An attacker who can influence the data being echoed to stdout during workflow execution can craft malicious payloads that inject arbitrary environment variables or prepend malicious directories to the PATH, affecting all subsequent steps in the job.

Root Cause

The root cause is the unconditional processing of deprecated ::set-env:: and ::add-path:: workflow commands in act's command parsing logic. Unlike the official GitHub Actions runner, which disabled these commands due to security risks, act continued to honor them without validation or opt-in requirements. This design flaw allows malicious actors to manipulate the execution environment when untrusted data is echoed during workflow steps.

Attack Vector

The attack vector is network-based and requires some user interaction or specific conditions to trigger. An attacker can exploit this vulnerability by:

1. Identifying a workflow that processes untrusted external data (e.g., pull request titles, issue comments, webhook payloads)
2. Crafting malicious input containing the deprecated workflow commands
3. Having this input echoed to stdout during workflow execution
4. The injected commands then modify environment variables or PATH for subsequent steps

For example, if a workflow echoes user-controlled data without sanitization, an attacker could inject ::set-env name=SECRET::malicious_value or ::add-path::/attacker/controlled/path to compromise the execution environment.

The exploitation mechanism involves workflow command injection through stdout processing. When act parses the output of a workflow step, it interprets lines matching the ::command:: pattern and executes them. By injecting these patterns into the stdout stream, attackers can set arbitrary environment variables that persist across subsequent steps or prepend malicious directories to the PATH, enabling execution of attacker-controlled binaries. For detailed technical analysis, see the GitHub Security Advisory GHSA-xmgr-9pqc-h5vw.

Detection Methods for CVE-2026-34041

Indicators of Compromise

• Presence of ::set-env:: or ::add-path:: patterns in workflow logs or stdout
• Unexpected environment variable changes between workflow steps
• Modified PATH variables pointing to non-standard directories
• Execution of binaries from unexpected locations during workflow runs

Detection Strategies

• Monitor workflow logs for deprecated command patterns (::set-env::, ::add-path::)
• Implement log analysis rules to detect injection patterns in CI/CD pipeline outputs
• Review workflow configurations that process external or untrusted data sources
• Audit act version deployments to identify vulnerable instances below 0.2.86

Monitoring Recommendations

• Enable verbose logging for act executions to capture all command processing
• Implement alerting on environment variable modifications during workflow execution
• Monitor for unusual PATH changes or binary executions in CI/CD environments
• Review audit logs for workflows processing untrusted external inputs

How to Mitigate CVE-2026-34041

Immediate Actions Required

• Upgrade act to version 0.2.86 or later immediately
• Audit existing workflows that process untrusted external data
• Review workflow logs for signs of exploitation or injection attempts
• Implement input sanitization for any data echoed to stdout in workflows

Patch Information

The vulnerability has been patched in act version 0.2.86. The fix disables processing of the deprecated ::set-env:: and ::add-path:: workflow commands, aligning act's behavior with the official GitHub Actions runner security posture.

For detailed information about the patch, see the GitHub Commit Details and download the patched version from the GitHub Release v0.2.86.

Workarounds

• Sanitize all untrusted input before echoing to stdout in workflow steps
• Use environment files ($GITHUB_ENV, $GITHUB_PATH) instead of deprecated stdout commands
• Implement strict input validation for workflows processing external data
• Consider isolating act executions in sandboxed environments until patching is complete

# Upgrade act to patched version
# Using go install
go install github.com/nektos/act@v0.2.86

# Using homebrew
brew upgrade act

# Verify installed version
act --version
# Should show: act version 0.2.86 or higher