CVE-2026-34041

The project act (a local runner for GitHub Actions) is vulnerable to environment injection in versions prior to 0.2.86 . The root cause is the unconditional processing of deprecated ::set-env:: and ::add-path:: workflow commands. An attacker can exploit this by injecting these commands when a wor...