{"id":"CVE-2026-63187","summary":"Logto: OS command injection vulnerability exists in the Commitlint workflow","details":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.","aliases":["GHSA-869c-8mm3-w5cj"],"modified":"2026-09-11T03:30:37.489168273Z","published":"2026-08-19T19:49:34.750Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63187.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/logto-io/logto/releases/tag/v1.41.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63187.json"},{"type":"ADVISORY","url":"https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63187"},{"type":"FIX","url":"https://github.com/logto-io/logto/commit/4a1cab21c14d26d288ffffc509cc2a8cae247b92"},{"type":"FIX","url":"https://github.com/logto-io/logto/pull/9112"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/logto-io/logto","events":[{"introduced":"3308305440d7e5fa964f67a63009c79f16c49da9"},{"fixed":"4a1cab21c14d26d288ffffc509cc2a8cae247b92"},{"fixed":"91e55698a42f99438cd41ec2b16a1fc51dbdab8a"}],"database_specific":{"extracted_events":[{"introduced":"1.40.1"},{"fixed":"1.41.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@logto/connector-smtp2go-email@1.0.0","v1.40.1","@logto/tunnel@0.3.8","@logto/translate@0.2.14","@logto/phrases-experience@1.13.3","@logto/core@1.40.1","@logto/core-kit@2.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63187.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"}]}