Nektos Act
4 CVEs affecting Nektos Act. Latest disclosed: 2026-08-24. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34041 | Critical | 9.8 | 2026-03-31 | act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-… |
CVE-2026-76847 | High | 8.8 | 2026-08-24 | act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that bac… |
CVE-2026-34042 | High | 8.2 | 2026-03-31 | act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all i… |
CVE-2023-22726 | High | 8.0 | 2023-01-20 | act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inp… |