CVE-2026-63187

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

• CWE-94

• https://github.com/logto-io/logto/commit/4a1cab21c14d26d288ffffc509cc2a8cae247b92
• https://github.com/logto-io/logto/pull/9112
• https://github.com/logto-io/logto/releases/tag/v1.41.0
• https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj
• https://github.com/logto-io/logto/security/advisories/GHSA-869c-8mm3-w5cj

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6317Use after free in Cast in Google Chrome prior to 147.0.7727.…8.8
• CVE-2026-63175PlaywrightCapture stored capture-specific configuration and …7.1
• CVE-2026-63177Malcolm is a network traffic analysis tool suite. Prior to v…7.1
• CVE-2026-63178Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Ent…6.5
• CVE-2026-63179Winter CMS is a content management system built on the Larav…4.9
• CVE-2026-6318Use after free in Codecs in Google Chrome prior to 147.0.772…8.8
• CVE-2026-63188Logto is the modern, open-source auth infrastructure for Saa…8.7
• CVE-2026-6319Use after free in Payments in Google Chrome on Android prior…7.5
• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-6321fast-uri decoded percent-encoded path separators and dot seg…7.5
• CVE-2026-63219GeoNetwork is a catalog application to manage spatially refe…8.6
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5