https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:23:52 +0000 https://cve.radiocsirt.org/vuln/cve-2026-63187 <p><strong>Affected:</strong> logto-io logto</p> <p>Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto&#39;s .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step&#39;s inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.</p> <p><strong>Affected:</strong> logto-io logto</p> <p>Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto&#39;s .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step&#39;s inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-63187