CVE-2026-34041: Act Set Env Add Path Without Unsecure Commands Guardcve-2026-34041-act-set-env-add-path-without-unsecure-commands-guard
The deprecated GitHub Actions workflow commands `set-env` and `add-path` are handled without checking the `ACTIONS_ALLOW_UNSECURE_COMMANDS` opt-in environment variable. Real GitHub Actions disabled these commands in October 2020 (CVE-2020-15228) because untrusted data echoed to a step's stdout can inject them and arbitrarily mutate environment variables or P
