Logto’s Commitlint workflow interpolated the raw GitHub pull request title into a shell echo command before piping it to commitlint. A title with a single quote could terminate the echo string and append arbitrary shell commands to the GitHub Actions runner. Although the runner used a read‑only GITHUB_TOKEN and did not expose repository secrets, injected commands could still alter or disrupt the temporary workflow execution. The vulnerability is classified as a code injection flaw (CWE‑94).

The affected product is Logto open‑source auth infrastructure, vendor logto-io:logto. Versions from 1.40.1 up to but not including 1.41.0 contain the flaw. Logto 1.41.0 and later include the fix.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the issue is not listed in CISA KEV. The attacker would need to submit a pull request to a repository using the vulnerable Logto workflow; the pull request title can be crafted to inject shell code. Execution occurs on the GitHub Actions runner, so while it cannot directly compromise secrets, it can interrupt or modify the CI pipeline, potentially leading to broader disruption if additional steps in the workflow rely on the compromised conditions.