CVE-2026-63187

CVE-2026-63187 is a command injection vulnerability in Logto's GitHub Actions commitlint workflow where github.event.pull_request.title is interpolated directly into a shell echo command without sanitization. A malicious PR title containing a single quote can break out of the string and inject arbitrary shell syntax. This is not a subtle flaw — it's the textbook example of what NOT to do in shell scripting, and the 1.41.0 patch presumably adds proper escaping or restructures the workflow to avoid inline interpolation. The CVSS 6.3 rating is misleading. The read-only GITHUB_TOKEN constrains impact to workflow disruption rather than secret exfiltration, but treat this as a ceiling, not a mitigation. A compromised commitlint workflow in a security library can manipulate what gets tagged as a valid commit, alter test output that downstream users trust, or inject content into release artifacts. The 2022 Codecov breach demonstrated that read-only CI credentials still enabled supply chain poisoning through artifact modification — the blast radius shifts from credential theft to trust manipulation, which is precisely what matters for an auth library that downstream SaaS and AI applications depend on. The deeper problem is the pattern itself. GitHub's own templates and Commitlint's documentation model this exact anti-pattern, piping user-controlled variables directly into shell commands. Security teams thoroughly review auth logic but treat workflow YAML as background infrastructure — a config file rather than code with execution semantics. This cognitive boundary is why shell injection, a vulnerability class characterized in the 1990s, keeps resurfacing in new execution contexts. The same team that would catch this in a Python web handler mentally files workflow files under 'configuration' and never applies the same threat model. Remediation is straightforward but must extend beyond this one workflow. Scan your entire .github/workflows directory for variable interpolation into shell contexts — specifically look for `echo ${{ github.event.* }}` patterns. Enable GitHub's Dependency Review action on all PRs to catch workflow changes. Add a YAML workflow linter to your CI pipeline that flags unescaped variable injection into shell commands. The fix in 1.41.0 matters less than what prevents this class of oversight: automated detection at PR time, not post-incident. And audit your full Actions directory — Logto runs nine workflows, each a parallel opportunity for the same pattern.

Reviewed through automated stages and approved by a human before publication.