HIGH8.8Go
GHSA-pc99-qmg4-rcff· CVE-2023-22726, GO-2023-1504act vulnerable to arbitrary file upload in artifact server
Modified: 9/10/2026
package
Go/github.com/nektos/act
pkg:go/github.com/nektos/act
HIGH8.2Go
GHSA-x34h-54cw-9825· CVE-2026-34042, GO-2026-4890act: actions/cache server allows malicious cache injection
Modified: 4/2/2026
HIGHGo
GHSA-xmgr-9pqc-h5vw· CVE-2026-34041, GO-2026-4891act: Unrestricted set-env and add-path command processing enables environment injection
Modified: 4/2/2026
—Go
GO-2023-1504· CVE-2023-22726, GHSA-pc99-qmg4-rcffact vulnerable to arbitrary file upload in artifact server in github.com/nektos/act
Modified: 3/3/2026
—Go
GO-2026-4890· CVE-2026-34042, GHSA-x34h-54cw-9825act: actions/cache server allows malicious cache injection in github.com/nektos/act
Modified: 4/2/2026
—Go
GO-2026-4891· CVE-2026-34041, GHSA-xmgr-9pqc-h5vwact: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act
Modified: 4/2/2026