What’s Vulnerable › Vulnerabilities

CVE-2026-63187: Logto: OS command injection vulnerability exists in the Commitlint workflow

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-09
• Weakness: CWE-94

Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

Affected products

• logto-io logto: from 1.40.1, < 1.41.0

References

• https://github.com/logto-io/logto/commit/4a1cab21c14d26d288ffffc509cc2a8cae247b92
• https://github.com/logto-io/logto/pull/9112
• https://github.com/logto-io/logto/releases/tag/v1.41.0
• https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj
• https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj

Get alerted when CVE-2026-63187 or the next vulnerability affects your stack