CVE-2026-63187: Logto GitHub Workflow RCE Vulnerability

CVE-2026-63187 Overview

CVE-2026-63187 is a command injection vulnerability in Logto, an open-source authentication infrastructure for SaaS and AI applications. The flaw affects versions from 1.40.1 up to (but not including) 1.41.0. The .github/workflows/commitlint.yml workflow interpolated github.event.pull_request.title directly into an inline echo command before piping the value to npx commitlint. An attacker submitting a pull request with a crafted title containing a single quote could break out of the shell string and execute arbitrary commands on the GitHub Actions runner. This vulnerability is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Attackers can inject arbitrary shell commands into the Logto CI workflow via a malicious pull request title, altering or disrupting ephemeral workflow execution on the GitHub Actions runner.

Affected Products

Logto versions 1.40.1 through 1.40.x
Logto GitHub Actions workflow commitlint.yml
Fixed in Logto version 1.41.0

Discovery Timeline

2026-08-19 - CVE-2026-63187 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63187

Vulnerability Analysis

The vulnerability resides in Logto's continuous integration pipeline rather than the product runtime. The commitlint.yml GitHub Actions workflow validates pull request titles against conventional commit rules. To do this, it echoed the raw pull request title into a shell command and piped the output to npx commitlint. Because the title was interpolated at the template layer, GitHub Actions expanded the untrusted value inline before the shell parsed it.

A pull request title containing a single quote terminates the enclosing string in the generated shell script. Any characters following the single quote are then interpreted as additional shell syntax. An external contributor opening a pull request can therefore execute arbitrary commands inside the workflow runner without repository write access.

The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets. This constrains the blast radius: attackers cannot exfiltrate long-lived credentials or push code directly. Injected commands can still alter workflow output, tamper with build artifacts, or disrupt CI operations on the ephemeral runner.

Root Cause

The root cause is unsafe template interpolation of untrusted input into a shell command [CWE-94]. GitHub Actions expressions such as ${{ github.event.pull_request.title }} are substituted before shell tokenization, so attacker-controlled data becomes executable script rather than a quoted argument.

Attack Vector

Exploitation requires an attacker to open a pull request against a vulnerable Logto fork or repository running the workflow. The pull request title carries the payload, terminating the echo string with a single quote and appending shell metacharacters. The full exploitation mechanism is documented in GitHub Security Advisory GHSA-869c-8mm3-w5cj.

No verified proof-of-concept code is published. The vulnerability class and payload construction are described in prose in the referenced advisory; see the fix commit and pull request #9112 for the corrected workflow.

Detection Methods for CVE-2026-63187

Indicators of Compromise

Unexpected processes spawned during the Commitlint on PR title step in GitHub Actions logs
Pull request titles containing single quotes, backticks, semicolons, or shell substitution syntax such as $(...)
Unusual outbound network connections originating from GitHub Actions runners during commitlint jobs

Detection Strategies

Audit GitHub Actions run logs for the commitlint.yml workflow and inspect the echoed pull request title for shell metacharacters
Review commit history of .github/workflows/ for unsafe patterns interpolating github.event.* values directly into run: steps
Enable GitHub Actions workflow run notifications for external contributor pull requests

Monitoring Recommendations

Continuously scan CI/CD workflows for template injection patterns using static analysis tools such as actionlint or zizmor
Forward GitHub Actions audit logs to a centralized SIEM for detection of anomalous runner behavior
Alert on pull request events where titles contain shell control characters before the workflow executes

How to Mitigate CVE-2026-63187

Immediate Actions Required

Upgrade Logto to version 1.41.0 or later, which contains the corrected commitlint.yml workflow
Review any downstream forks that copied the vulnerable workflow and apply the equivalent patch
Rotate any credentials that may have been exposed to affected workflow runs, even though the GITHUB_TOKEN was read-only

Patch Information

The fix is available in Logto release v1.41.0. The corrective change moves the pull request title out of the inline shell command and passes it through an environment variable, preventing shell interpretation. See the fix commit and pull request #9112 for full details.

Workarounds

Pass untrusted GitHub event data through an environment variable and reference it as "$VAR" inside the shell command instead of using ${{ ... }} interpolation
Restrict the commitlint.yml workflow to trusted contributors using if: conditions on the pull request author association
Temporarily disable the commitlint workflow until the upgrade to 1.41.0 is deployed

bash

# Configuration example: safe handling of PR title in GitHub Actions
- name: Commitlint on PR title
  env:
    PR_TITLE: ${{ github.event.pull_request.title }}
  run: echo "$PR_TITLE" | npx commitlint