act: Unrestricted set-env and add-path command processing enables environment injection
Date: 2026-03
Affected: go/github.com/nektos/act
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-34041
CWE: CWE-74

## Summary act unconditionally processes the deprecated `::set-env::` and `::add-path::` workflow commands, which GitHub Actions disabled in October 2020 (CVE-2020-15228, GHSA-mfwh-5m23-j46w) due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This makes `act` strictly less secure than GitHub Actions for the same workflow file. ## Vulnerable Code **`pkg/runner/command.go`, lines 52-58:** ```go switch command { case "set-env": rc.setEnv(ctx, kvPairs, arg) case "set-output": rc.setOutput(ctx, kvPairs, arg) case "add-path": rc.addPath(ctx, arg) ``` There is no check for the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable. The string `ACTIONS_ALLOW_UNSECURE_COMMANDS` does not appear anywhere in the act codebase. On GitHub Actions, these commands are rejected unless `ACTIONS_ALLOW_UNSECURE_COMMANDS=true` is set: ``` Error: The `set-env` command is disabled. Please upgrade to using Environment Files or opt-in by setting ACTIONS_ALLOW_UNSECURE_COMMANDS=true. ``` ## PoC: Environment and PATH Injection via PR Title **Tested on:** act 0.2.84, Docker Desktop 29.1.2, macOS Darwin 24.5.0 **Step 1 — Create a workflow that logs PR metadata:** `.github/workflows/vuln.yml`: ```yaml name: Vulnerable Workflow on: [pull_request] jobs: build: runs-on: ubuntu-latest steps: - name:


Mitigations:

Architectural layers (MAESTRO):