Threats affecting pkg:github/nektos/act

CVE-2026-76847 is a high-severity vulnerability in nektos act versions 0.2.81 through 0.2.89. The vulnerability arises because the HTTP Artifacts V4 backend does not properly authorize requests, allowing any client on the network to access artifact operations without verifying ownership. Additionally, the HMAC key used to authenticate signed URLs is hardcoded and weak, making signature forgery possible. The backend is exposed to the network by default, enabling unauthorized reading, overwriting, or deletion of artifacts from concurrent jobs, potentially exposing sensitive build outputs such as secrets and deployment credentials.

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86.