CVE-2026-58412

Name of the Vulnerable Software and Affected Versions Filecoin Pin versions prior to 1.1.0

Description In the upload GitHub Action, the fork detection mechanism within upload-action/src/build.js only verifies event.pull request. In a two-workflow configuration, a privileged workflow run workflow may download and upload an artifact produced by an untrusted fork pull-request workflow. Since workflow run lacks event.pull request, the isForkPR variable is set to false and uploadStatus becomes pending-upload. The action subsequently processes workflow run.pull requests without re-verifying the fork status before using the walletPrivateKey to upload the artifact. This allows an external contributor to store attacker-controlled artifacts using the repository owner's Filecoin wallet, leading to unauthorized storage costs, dataset pollution, and depletion of wallet funds. This does not require the disclosure of the wallet private key.

Recommendations Update Filecoin Pin to version 1.1.0 or later. Migrate from the 0.x action line to a fixed 1.x release.