CVE-2026-63187

Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9

Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote can terminate the echo string, allowing the execution of arbitrary shell commands on the GitHub Actions runner. While the trigger uses a read-only GITHUB TOKEN and does not expose repository secrets, injected commands can alter or disrupt the ephemeral workflow execution.

Recommendations Update to version 1.41.0.