Shell Command Injection Vulnerability in Logto Auth Infrastructure
CVE-2026-63187

6.3MEDIUM

Key Information:

Vendor

Logto-io

Status
Logto
Vendor
CVE Published:
19 August 2026

What is CVE-2026-63187?

A vulnerability in Logto's .github/workflows/commitlint.yml allows for potential shell command injection through the interpolation of unvalidated pull request titles. Versions 1.40.1 to 1.41.0 are affected. Specifically, if a pull request title includes a single quote, it could improperly terminate the echo string, enabling the injection of arbitrary commands during GitHub Actions workflow execution. Although the pull request trigger utilizes a read-only GITHUB_TOKEN, the ability to alter workflow execution can lead to disruptions. This issue has been addressed in version 1.41.0.

Affected Version(s)

logto >= 1.40.1, < 1.41.0

References

https://github.com/logto-io/logto/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/logto-io/logto/pull/9112
x_refsource_MISC
https://github.com/logto-io/logto/commit/4a1cab21c14d26d2...
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.