cloudflare/pages-action (all published versions, incl. v1 moving tag) contains an RCE in src/index.ts reachable from certain GitHub Actions workflow configurations via OS command injection (CWE-78). Exploitation can exfiltrate CLOUDFLARE_API_TOKEN and GITHUB_TOKEN. No patches; migrate workflows to cloudflare/wrangler-action before 2026-09-18.