Description

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T20:17:20.063Z",
  "pubdate": "2026-08-19T20:17:20.063Z",
  "executiveSummary": "A command injection vulnerability exists in Logto's GitHub Actions workflow configuration, specifically within the .github/workflows/commitlint.yml file. The vulnerability arises from the insecure direct interpolation of untrusted pull request metadata into an inline shell command.\nSpecifically, the input vector involves the github.event.pull_request.title parameter, which is passed directly into an echo command before being piped to npx commitlint. An attacker capable of submitting a pull request can supply a crafted title containing shell metacharacters, such as a single quote, to escape the intended string context and append arbitrary shell commands.\nThe affected systems include Logto versions ranging from 1.40.1 up to, but not including, the patched version 1.41.0. While the vulnerable workflow utilizes a read-only GITHUB_TOKEN and does not expose high-privilege repository secrets, successful exploitation allows an attacker to execute arbitrary shell commands on the ephemeral GitHub Actions runner environment.\nThis execution capability enables attackers to alter or disrupt workflow execution, manipulate build processes, or potentially leverage the runner environment for lateral movement within the context of the workflow's permissions. The risk is constrained by the read-only token scope, but the integrity of the CI/CD pipeline execution is compromised. Exploitation requires the ability to open a pull request against the target repository, making public-facing or collaborative repositories particularly susceptible if unpatched.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-controlled data within a CI/CD pipeline execution context. The vulnerable component is the GitHub Actions workflow file located at .github/workflows/commitlint.yml, specifically within the step designated for validating pull request titles using Commitlint.\nThe root cause of the vulnerability is the unsafe interpolation of the github.event.pull_request.title context variable directly into an inline shell script execution block. Instead of passing the pull request title securely via environment variables and referencing it safely within the shell script, the workflow dynamically constructs the shell command string by substituting the raw title property directly into an echo statement.\nThe attack flow proceeds as follows: an unauthenticated or low-privileged attacker creates a pull request against the Logto repository. In the title of the pull request, the attacker injects a malicious payload containing shell control characters, most notably a single quote (') to prematurely terminate the string literal argument of the echo command, followed by command separators and arbitrary shell commands.\nWhen the pull_request event triggers the GitHub Actions runner, the workflow executes the inline shell script. The shell parses the injected payload, closes the echo string prematurely, executes the attacker-supplied commands in the context of the runner operating system, and subsequently pipes data to npx commitlint.\nThe affected versions are strictly identified as 1.40.1 up to 1.41.0. Authentication requirements are minimal, as standard repository contribution models typically permit any user to open a pull request, granting the attacker the necessary entry point to supply the malicious title. Privilege requirements are limited to the permissions granted to the pull_request trigger context, which in this scenario utilizes a read-only GITHUB_TOKEN that explicitly restricts access to sensitive repository secrets.\nThe payload behavior on the ephemeral runner includes the execution of arbitrary operating system commands permitted by the runner environment and token constraints. Post-exploitation impact is limited due to the absence of exposed repository secrets and the read-only nature of the token, but remains restricted to disrupting the workflow execution, tampering with ephemeral build artifacts, or interacting with network endpoints accessible from the runner."
}