The vulnerability lies in the Filecoin Pin upload GitHub Action, where the fork‑detection logic only inspects the event.pull_request field of the initial pull‑request trigger. A privileged workflow_run that lacks this field incorrectly marks the source as not a fork, allowing the action to initialize a wallet with the repository owner’s private key and upload attacker‑controlled artifacts. As a result, the repository owner’s Filecoin wallet is used to store unwanted data, incurring storage costs, polluting the dataset, and draining configured funds without requiring disclosure of the private key.

All instances of filecoin-project/filecoin-pin before release 1.1.0 are affected, as the flaw exists in the upload‑action tooling bundled with those releases.

Based on the description, it is inferred that attackers can exploit the flaw by creating a forked pull request that triggers the privileged workflow_run, bypassing fork checks and uploading malicious artifacts. With a CVSS score of 8.2 the vulnerability is high severity. Although EPSS is not available, the public nature of GitHub Actions and the ability for an external contributor to create a forked pull request make exploitation straightforward. The flaw is not yet listed in KEV, but attackers can trigger the privileged workflow_run to use the stored wallet credentials and spend the owner’s resources. The risk is therefore significant for any repository maintaining the vulnerable action and not restricting forked workflows.