What is the CVSS score of CVE-2026-44590?

CVE-2026-44590 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.8%.

Which versions of Sherlock are affected by CVE-2026-44590?

Sherlock's GitHub Actions workflow contains a critical command injection vulnerability (CVE-2026-44590) allowing arbitrary code execution without approval, creating direct supply-chain risk to the…. A patch is available.

How to fix or mitigate CVE-2026-44590?

Within 24 hours: Restrict repository access or disable the validate_modified_targets.yml workflow to prevent untrusted pull requests. Within 7 days: Upgrade Sherlock to version 0.16.1 and audit CI/CD logs for suspicious execution activity. Within 30 days: Implement mandatory pull request approvals, enforce code review sign-offs, and audit GitHub Actions permissions across all projects using this tool.

Sherlock CVE-2026-44590

EUVD-2026-32638 CRITICAL

OS Command Injection (CWE-78)

2026-05-27 GitHub_M

Command Injection Sherlock

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 27, 2026 - 22:04 EUVD

Analysis Generated

May 27, 2026 - 20:51 vuln.today

CVE Published

May 27, 2026 - 19:23 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.

AnalysisAI

Command injection in the Sherlock username-hunting tool's CI/CD pipeline (versions prior to 0.16.1) allows any GitHub user to run arbitrary commands on the project's GitHub Actions runner. The flaw lives in the validate_modified_targets.yml workflow, which uses the dangerous pull_request_target trigger; simply opening a pull request executes attacker-controlled code with no approval, review, or merge required. Fixed in 0.16.1; with a CVSS of 9.3 it is a high-severity supply-chain issue, though no public exploit was identified at time of analysis and the technique class is well documented.