CVE-2026-63187: CWE-94: Improper Control of Generation of Code ('Code Injection') in logto-io logto
Description
CVE-2026-63187 is a code injection vulnerability in logto-io's logto product affecting versions from 1.40.1 up to but not including 1.41.0. The issue arises from unsafe interpolation of the GitHub pull request title into a shell command within a GitHub Actions workflow, allowing an attacker to inject arbitrary shell commands. The vulnerability is mitigated by the use of a read-only GITHUB_TOKEN that does not expose repository secrets, limiting impact to disruption or alteration of the ephemeral workflow execution. This vulnerability is fixed in version 1.41.0.
CVSS v3.1
Score 6.3medium
Affected software
logto-io
logto
pkg:github/logto-io/logtoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Logto versions >=1.40.1 and <1.41.0 contain a code injection vulnerability (CWE-94) in the .github/workflows/commitlint.yml file. The workflow directly interpolates the GitHub pull request title into an inline echo command without sanitization. A pull request title containing a single quote can break out of the echo string and append arbitrary shell commands executed on the GitHub Actions runner. Although the injected commands run with a read-only GITHUB_TOKEN and do not have access to repository secrets, they can disrupt or alter the ephemeral workflow execution. The vulnerability is resolved in version 1.41.0.
Potential Impact
An attacker who can control the pull request title can inject arbitrary shell commands into the GitHub Actions workflow execution environment. Due to the read-only GITHUB_TOKEN and lack of access to repository secrets, the impact is limited to potential disruption or alteration of the ephemeral workflow run, without direct compromise of repository secrets or persistent system compromise.
Mitigation Recommendations
Upgrade to logto version 1.41.0 or later, where the vulnerability is fixed. No additional mitigation is required as the fix addresses the unsafe interpolation of the pull request title.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-15T22:13:00.721Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a86e0f8acd9273b498385ce
Added to database: 08/20/2026, 11:11:52 UTC
Last enriched: 09/11/2026, 05:03:57 UTC
Last updated: 10/04/2026, 16:08:40 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.