CVE-2026-44590 Details
Description
Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.
A command injection vulnerability has been identified in the GitHub Actions workflow 'validate_modified_targets.yml' of the Sherlock project, prior to version 0.16.1. This vulnerability allows any GitHub user to execute arbitrary commands on the Continuous Integration (CI) runner and exfiltrate the 'GITHUB_TOKEN' by opening a pull request. The issue arises because the workflow processes JSON key names controlled by the pull request author, injecting them directly into a shell command. Exploitation of this vulnerability does not require approval, review, or merge of the pull request.
Users are advised to update to Sherlock version 0.16.1 or later, and to modify the 'validate_modified_targets.yml' workflow to replace direct JSON key name interpolation with a shell environment variable, while disabling credential persistence.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sherlock-project sherlock | <= v0.16.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |