CVE-2026-63187: Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pullrequest trigger used a read-only GITHUBTOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Logtoto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
Which repositories are exposed?
Repositories using the affected Logto Commitlint GitHub Actions workflow are exposed when a pull request triggers that workflow. The affected versions are 1.40.1 through versions before 1.41.0.
What does an attacker need to exploit this issue?
An attacker needs to cause a pull request workflow run with a crafted pull request title. A single quote in the title can terminate the inline echo string and allow additional shell commands to be appended.
Are repository secrets or write-capable tokens exposed?
No. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets. However, injected commands can alter or disrupt the ephemeral GitHub Actions runner execution.
What should be done if the workflow cannot be updated immediately?
Avoid running the affected Commitlint workflow on pull requests with untrusted titles until the workflow is updated. The issue is fixed in Logto version 1.41.0.