Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-63187Logto: OS command injection vulnerability exists in the Commitlint workflow

Medium 6.3

In plain English

A medium-severity code injection in logto from logto-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 66.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

Affected products (as reported)

Vendor	Product	Versions
logto-io	logto	>= 1.40.1, < 1.41.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj x_refsource_CONFIRM
https://github.com/logto-io/logto/pull/9112 x_refsource_MISC
https://github.com/logto-io/logto/commit/4a1cab21c14d26d288ffffc509cc2a8cae247b92 x_refsource_MISC
https://github.com/logto-io/logto/releases/tag/v1.41.0 x_refsource_MISC