- Latest release
- v0.2.97 (Nov 4, 2026): no advisory affects it
- Newest unaffected release
- v0.2.97 (Nov 4, 2026), the latest release
- Advisories
- 3 · 3 high
- Releases
- 107 since v0.0.1 (Jan 13, 2019)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-34042Affects v0.0.1 to v0.2.85 (v0.2.86 is outside it)
- CVE-2026-34041Affects v0.0.1 to v0.2.85 (v0.2.86 is outside it)
- CVE-2023-22726Affects v0.0.1 to v0.2.39 (v0.2.40 is outside it)
Advisories 3
- CVE-2026-34042High 8.2
act: actions/cache server allows malicious cache injection
Affected: fixed in 0.2.86.
Fixed in v0.2.86 (released Mar 25, 2026, 6 days before disclosure).
The latest release, v0.2.97, is not affected.
- CVE-2026-34041High 7.7
act: Unrestricted set-env and add-path command processing enables environment injection
Affected: fixed in 0.2.86.
Fixed in v0.2.86 (released Mar 25, 2026, 6 days before disclosure).
The latest release, v0.2.97, is not affected.
- CVE-2023-22726High 8.0
Unrestricted file upload leading to privilege escalation in act
Affected: fixed in 0.2.40.
Fixed in v0.2.40 (released Jan 16, 2023, 4 days before disclosure).
The latest release, v0.2.97, is not affected.