CVE-2026-58412

The Filecoin Pin IPFS Pinning Service API implementation contains a fork bypass vulnerability in the privileged GitHub Actions workflow (prior to version 1.1.0 ). The root cause is located in upload-action/src/build.js, where the fork detection logic only checks event.pull_request. In a two-workf...