act
v0.2.97Run your GitHub Actions locally 🚀
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- MITPermissive · OSI-approved
- Security
- 10 advisories6 high, 3 medium, 1 low · Scorecard 7.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
72.7k stars · 2.1k forks · 366 open issues · last release 10 days ago · data checked 53 minutes ago
Security advisories
All advisories on GitHubThe 10 most recent advisories published by the maintainers: 6 high, 3 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-5xfg-9629-mqggNov 4, 2026Masking leaves part of a secret in the log when one masked value contains another
- Affected
- >= 0.2.26, < 0.2.97
- Patched in
- 0.2.97
- highGHSA-9j7q-g3ch-2283Nov 3, 2026Path Traversal in 'uses:' and 'runs.main' chains to Host RCE in nektos/act
- Affected
- < 0.2.96
- Patched in
- 0.2.96
- highGHSA-jpm2-x6wf-fxjcNov 3, 2026Project .actrc allowlist bypass via boolean, inline-assignment, and clustered short-flag argument smuggling in nektos/act
- Affected
- < 0.2.95
- Patched in
- 0.2.95
- lowGHSA-9xfw-6wqp-rq8fOct 31, 2026Local actions (uses: ./…) write trampoline.js to an arbitrary host path, with no containment check
- Affected
- <= 0.2.92
- Patched in
- 0.2.93
- mediumGHSA-74m9-q5m3-x53fOct 31, 2026A Docker action's build context can root outside the action checkout, exposing host file contents to the action
- Affected
- <= 0.2.92
- Patched in
- 0.2.93
- highGHSA-7x4h-3p32-rrc3Oct 28, 2026Container options override runner CapDrop/AppArmor/seccomp via mergo.WithOverride
- Affected
- <= 0.2.91
- Patched in
- 0.2.92
- mediumGHSA-jm9r-836x-3vhhMar 26, 2026CI/CD pipeline vulnerabilities in GitHub Actions workflows
- Affected
- > 0
- highCVE-2026-34042Mar 25, 2026remote code execution possible -- actions/cache server allows malicious cache injection
- Affected
- <= 0.2.85; all
- Patched in
- 0.2.86
- highCVE-2026-34041Mar 25, 2026::set-env:: and ::add-path:: Workflow Commands Unconditionally Processed
- Affected
- <= 0.2.85
- Patched in
- 0.2.86
- highCVE-2023-22726Jan 16, 2023Github Security Lab: GHSL-2023-004
- Affected
- <=0.2.39
- Patched in
- 0.2.40