github.com/nektos/act (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/nektos/act, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2026-34041 — CVSS 9.8 (critical): act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated…
• CVE-2026-34042 — CVSS 8.2 (high): act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to…
• CVE-2023-22726 — CVSS 8.0 (high): act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does…