GHSA-x34h-54cw-9825

Source

https://github.com/advisories/GHSA-x34h-54cw-9825

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x34h-54cw-9825/GHSA-x34h-54cw-9825.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x34h-54cw-9825

Aliases

Published

2026-03-27T19:35:16Z

Modified

2026-04-02T21:26:09Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator

Summary

act: actions/cache server allows malicious cache injection

Details

act's built-in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it — including someone anywhere on the internet — to create caches with arbitrary keys and retrieve all existing caches. If one can predict which cache keys will be used by local actions, one can create malicious caches containing whatever files one pleases, most likely allowing arbitrary remote code execution within the Docker container.

Discovery

Discovered while discussing forgejo/runner#294.

Proposed Mitigation

It was discussed to append a secret to ACTIONS_CACHE_URL to retain compatibility with GitHub's cache action and still allow authorization. Forgejo is considering also encoding which repo is currently being run in CI into the secret in the URL to prevent unrelated repos using the same (probably global) runner from seeing each other's caches.

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-27T19:35:16Z",
    "nvd_published_at":  "2026-03-31T03:15:58Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/nektos/act

Package

Name: github.com/nektos/act; View open source insights on deps.dev
Purl: pkg:golang/github.com/nektos/act

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.2.86

Database specific

last_known_affected_version_range

"<= 0.2.85"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-x34h-54cw-9825/GHSA-x34h-54cw-9825.json"