Act
Monthly
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
act is a project which allows for local running of github actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the exploitable code paths are visible in public source and trivially reproducible.
act is a project which allows for local running of github actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.