CVE-2026-44590: Sherlock-Project Sherlock

Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.

Affected products

• Sherlock-Project Sherlock: before 0.16.1 (fixed in 0.16.1)

Published 2026-05-27. Last modified 2026-06-17.