Filecoin-project vulnerabilities
We track 2 vulnerabilities in Filecoin-project products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Filecoin-project vulnerabilities
- 8.2 High severity
filecoin-pin: Incorrect Authorization
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented two-workflow pattern,
- 7.5 High severity
go-f3: Integer Overflow or Wraparound
go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer ove