CVE-2026-63187
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.
Risk Assessment
The risk involves potential disruption of CI/CD processes in the Logto repository, which could lead to unauthorized pipeline modifications or denial of service. Lack of secret exposure limits impact, but it still threatens process integrity.
Recommendation
Upgrade Logto to version 1.41.0 or later immediately. Additionally, consider restricting GitHub Actions token permissions and using safe interpolation methods for user-controlled data.
Original NVD description (English source)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.