Detections
Analytics

SCA: security update for filecoin-pin (GHSA-m5ph-mmg5-6w5h)

medium Tenable Self-Hosted Container Security Plugin ID 478584

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon
 deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a
 caller-supplied CID with `CID.parse` and passes it to `pinStore.pin`, but does not enforce request rate
 limits or per-user quotas. In `src/filecoin-pin-store.ts`, each pin independently schedules
 `_processPinInBackground` with `setTimeout` without a queue, semaphore or concurrency cap, then
 recursively traverses the full DAG using `helia.pins.add(cid)`. The per-pin Helia/Bitswap node in
 `src/create-pinning-helia.ts` has no application-level byte, block or traversal-time limits. Blocks are
 written under `carStoragePath` by `src/core/car/car-blockstore-base.ts` and `src/core/car/car-file-
 backend.ts`, with `stats.totalSize` updated only after writing. An authenticated caller, or an anonymous
 caller when `ALLOW_NO_AUTH=true`, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p
 resources, causing service degradation or host/process failure and leaving partial CAR files requiring
 recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no
 bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied `origins` can point
 to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure.
 Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.
 (CVE-2026-62300)

Solution

Update the filecoin-pin library and its related packages to version 1.1.1 or later.

See Also

https://github.com/advisories/GHSA-m5ph-mmg5-6w5h

Plugin Details

Severity: Medium

ID: 478584

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-62300

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 10/30/2026

Reference Information

CVE: CVE-2026-62300

cwe: CWE-400