CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Attackers can execute arbitrary shell commands on GitHub Actions runners via malicious pull request titles in Logto's commitlint workflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-63187?
CVE-2026-63187 is a medium-severity command injection vulnerability in logto-io logto, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-63187?
How do I fix CVE-2026-63187?
No fix has been published for CVE-2026-63187 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-63187 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63187 exists.
Sources
Also known as GHSA-869c-8mm3-w5cj.