What is the CVSS score of CVE-2026-44590?

CVE-2026-44590 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.8%.

Which versions of Sherlock are affected by CVE-2026-44590?

Sherlock's GitHub Actions workflow contains a critical command injection vulnerability (CVE-2026-44590) allowing arbitrary code execution without approval, creating direct supply-chain risk to the…. A patch is available.

How to fix or mitigate CVE-2026-44590?

Within 24 hours: Restrict repository access or disable the validate_modified_targets.yml workflow to prevent untrusted pull requests. Within 7 days: Upgrade Sherlock to version 0.16.1 and audit CI/CD logs for suspicious execution activity. Within 30 days: Implement mandatory pull request approvals, enforce code review sign-offs, and audit GitHub Actions permissions across all projects using this tool.

Sherlock CVE-2026-44590

EUVD-2026-32638 CRITICAL

OS Command Injection (CWE-78)

2026-05-27 GitHub_M

Command Injection Sherlock

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 27, 2026 - 22:04 EUVD

Analysis Generated

May 27, 2026 - 20:51 vuln.today

CVE Published

May 27, 2026 - 19:23 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.

AnalysisAI

Command injection in the Sherlock username-hunting tool's CI/CD pipeline (versions prior to 0.16.1) allows any GitHub user to run arbitrary commands on the project's GitHub Actions runner. The flaw lives in the validate_modified_targets.yml workflow, which uses the dangerous pull_request_target trigger; simply opening a pull request executes attacker-controlled code with no approval, review, or merge required. Fixed in 0.16.1; with a CVSS of 9.3 it is a high-severity supply-chain issue, though no public exploit was identified at time of analysis and the technique class is well documented.