CVE-2026-58412

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in upload-action/src/build.js checks only event.pullrequest. In the documented two-workflow pattern, an untrusted fork pull-request workflow...

CVE-2026-62300

Filecoin Pin versions up to and including 1.1.0 are vulnerable to uncontrolled resource consumption (CWE-400 ) via unbounded DAG pinning. The POST /pins endpoint in src/filecoin-pinning-server.ts fails to enforce rate limits or per-user quotas, allowing callers to submit large DAGs. The system in...

EUVD-2026-114448

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce...

CVE-2026-62300 Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce...

CVE-2026-58412

The Filecoin Pin IPFS Pinning Service API implementation contains a fork bypass vulnerability in the privileged GitHub Actions workflow (prior to version 1.1.0 ). The root cause is located in upload-action/src/build.js, where the fork detection logic only checks event.pull_request. In a two-workf...

CVE-2026-58412 Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in upload-action/src/build.js checks only event.pullrequest. In the documented two-workflow pattern, an untrusted fork pull-request workflow...

CVE-2026-62300: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce...

CVE-2026-58412: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in upload-action/src/build.js checks only event.pullrequest. In the documented two-workflow pattern, an untrusted fork pull-request workflow...