CVE-2026-44590

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9
https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Sherlock rastrea cuentas de redes sociales por nombre de usuario en diversas redes sociales. Antes de la versión 0.16.1, el flujo de trabajo de GitHub Actions validate_modified_targets.yml es vulnerable a inyección de comandos a través del activador pull_request_target. Cualquier usuario de GitHub puede ejecutar comandos arbitrarios en el ejecutor de CI y exfiltrar el GITHUB_TOKEN abriendo una solicitud de extracción. No se requiere aprobación, revisión ni fusión. Esta vulnerabilidad está corregida en la versión 0.16.1.

Information

Published : 2026-05-27 20:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44590

Mitre link : CVE-2026-44590

CVE.ORG link : CVE-2026-44590

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-44590", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44590", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T13:27:58.922623Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sherlock-project", "product": "sherlock", "versions": [{"status": "affected", "version": "< 0.16.1"}]}]}], "published": "2026-05-27T20:16:37.293", "references": [{"url": "https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9", "source": "security-advisories@github.com"}, {"url": "https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1."}, {"lang": "es", "value": "Sherlock rastrea cuentas de redes sociales por nombre de usuario en diversas redes sociales. Antes de la versi\u00f3n 0.16.1, el flujo de trabajo de GitHub Actions validate_modified_targets.yml es vulnerable a inyecci\u00f3n de comandos a trav\u00e9s del activador pull_request_target. Cualquier usuario de GitHub puede ejecutar comandos arbitrarios en el ejecutor de CI y exfiltrar el GITHUB_TOKEN abriendo una solicitud de extracci\u00f3n. No se requiere aprobaci\u00f3n, revisi\u00f3n ni fusi\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.16.1."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}