Command Injection Vulnerability in Sherlock by GitHub
CVE-2026-44590

9.3CRITICAL

Key Information:

Vendor

Sherlock-project

Status
Sherlock
Vendor
CVE Published:
27 May 2026

What is CVE-2026-44590?

The Sherlock project, designed for hunting social media accounts by username, has a vulnerability in its GitHub Actions workflow (validate_modified_targets.yml) prior to version 0.16.1. This vulnerability allows any GitHub user to exploit the pull_request_target trigger, executing arbitrary commands on the CI runner. As a result, it is possible for attackers to exfiltrate the GITHUB_TOKEN without requiring prior approval, review, or merging of the pull request. The issue has been addressed in version 0.16.1, where necessary security measures have been implemented to prevent such unauthorized command executions.

Affected Version(s)

sherlock < 0.16.1

References

https://github.com/sherlock-project/sherlock/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.