CVE-2026-113429

Legacy v1 to v3 Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions jo...