GO-2026-4890 act: actions/cache server allows malicious cache injection in github.com/nektos/act

act: actions/cache server allows malicious cache injection in github.com/nektos/act...

PT-2026-29938

act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act...

PT-2026-29937

act: actions/cache server allows malicious cache injection in github.com/nektos/act...

Privilege Escalation

github.com/nektos/act is vulnerable to Privilege Escalation. The vulnerability exists in multiple functions of server.go because the path inputs are not sanitized which allows an attacker to download and overwrite arbitrary files on the host...