CVE-2026-62300

Filecoin Pin versions up to and including 1.1.0 are vulnerable to uncontrolled resource consumption (CWE-400 ) via unbounded DAG pinning. The POST /pins endpoint in src/filecoin-pinning-server.ts fails to enforce rate limits or per-user quotas, allowing callers to submit large DAGs. The system in...

CVE-2026-58412

The Filecoin Pin IPFS Pinning Service API implementation contains a fork bypass vulnerability in the privileged GitHub Actions workflow (prior to version 1.1.0 ). The root cause is located in upload-action/src/build.js, where the fork detection logic only checks event.pull_request. In a two-workf...