Vulnerabilities

TI-2026-53683 CVE-2026-76847 · GHSA-crfw-6q9f-w49f

act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

MEDIUM 40

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00351 Published 2026-08-24 No fix listed CWE-321

TI-2026-26367 CVE-2026-34042 · GHSA-x34h-54cw-9825

LOW 36

act is a project which allows for local running of github actions.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00467 Published 2026-03-31 Fixed in 0.2.86 CWE-862

TI-2026-26366 CVE-2026-34041 · GHSA-xmgr-9pqc-h5vw

HIGH 75

act is a project which allows for local running of github actions.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00643 Published 2026-03-31 Fixed in 0.2.86 CWE-74

TI-2023-08900 CVE-2023-22726 · GHSA-pc99-qmg4-rcff

HIGH 73

act is a project which allows for local running of github actions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01292 Published 2023-01-20 Fixed in 0.2.40 CWE-434