Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚡ New CVE Alert: CVE-2026-34041 📊 Severity: 7.7 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-34041 #CVE-2026-34041 #CVE #High #CyberSecurity #InfoSec https://t.co/ATnOu3lMQK
Post summary
This post announces the new CVE‑2026‑34041 with a severity score of 7.7 and links to the NVD entry, but provides no technical, exploit, or mitigation details.
CVE-2026-34041 act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: … https://www.cve.org/CVERecord?id=CVE-2026-34041
Post summary
The post reports a CVE affecting the act tool, indicating that versions prior to 0.2.86 improperly handle deprecated GitHub Actions directives, but it provides no evidence of exploitation, PoC, or patch information.
CVE-2026-34041 act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env: https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34041
Post summary
The snippet reports CVE‑2026‑34041, noting that act versions prior to 0.2.86 process deprecated ::set-env, but provides no further technical or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nektos | act | - | - | - |