CVE-2026-34041

CVE-2026-34041 is a critical vulnerability affecting versions of the 'act' project prior to 0.2.86, which allows local execution of GitHub Actions. It enables environment injection by unconditionally processing deprecated workflow commands like ::set-env:: and ::add-path:: when untrusted data is echoed to stdout. This allows an attacker to set arbitrary environment variables or modify the PATH, posing a severe risk with a CVSS score of 9.8 (Critical). The vulnerability has a network-based, low-complexity attack vector, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog and lacking public exploit code or community discussion, its "Hot List: Active" status indicates a high potential for future exploitation.