CVE-2026-63187

Received Received - Intake

Command Injection in Logto GitHub Actions Workflow

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-63187

EUVD

EUVD-2026-62865

Affected Vendors & Products

Vendor	Product	Version / Range
logto	logto	to 1.41.0 (inc)
logto	logto	1.41.0
logto	logto	From 1.40.1 (inc) to 1.41.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in Logto's GitHub Actions workflow. The Commitlint step directly used the pull request title in a bash command without sanitization. An attacker could craft a title with special characters like a single quote and semicolon to break out of the command and execute arbitrary shell commands on the GitHub Actions runner.

Detection Guidance

This vulnerability is specific to the Logto repository's GitHub Actions workflow and cannot be detected on general networks or systems. It involves malicious pull request titles in the Logto repository triggering command injection in the Commitlint workflow. No standard commands can detect this outside the Logto repository environment.

Impact Analysis

The impact is limited to the GitHub Actions runner environment. An attacker could alter or disrupt the workflow execution but could not access repository secrets or data due to the read-only GITHUB_TOKEN. The vulnerability allows arbitrary code execution within the isolated runner sandbox.

Mitigation Strategies

Update Logto to version 1.41.0 or later to apply the fix that prevents command injection in the Commitlint workflow.
Review GitHub Actions workflows in your repositories to ensure untrusted context variables like pull request titles are not directly interpolated into shell commands without sanitization.
Use environment variables to pass untrusted input to shell commands instead of inline interpolation to prevent injection attacks.

Hi! I’m here to help you understand CVE-2026-63187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70