CVE-2026-63187: Logto-Io Logto

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

Affected products

• Logto-Io Logto: from 1.40.1, before 1.41.0 (fixed in 1.41.0)

Published 2026-08-19. Last modified 2026-09-09.