CyberRota Analysis
AI-GeneratedThe vulnerability affects the Logto GitHub Actions workflow, specifically in versions 1.40.1 to 1.41.0, where user-controlled pull request titles can be exploited to inject arbitrary shell commands into the workflow execution. Although the GITHUB_TOKEN used is read-only and does not expose repository secrets, successful exploitation could disrupt the workflow's execution. Organizations utilizing Logto for their CI/CD processes should prioritize updating to version 1.41.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.