What is the CVSS score of CVE-2026-44590?

CVE-2026-44590 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.8%.

Sherlock CVE-2026-44590

Q: Which versions of Sherlock are affected by CVE-2026-44590?

Sherlock's GitHub Actions workflow contains a critical command injection vulnerability (CVE-2026-44590) allowing arbitrary code execution without approval, creating direct supply-chain risk to the…. A patch is available.

Q: How to fix or mitigate CVE-2026-44590?

Within 24 hours: Restrict repository access or disable the validate_modified_targets.yml workflow to prevent untrusted pull requests. Within 7 days: Upgrade Sherlock to version 0.16.1 and audit CI/CD logs for suspicious execution activity. Within 30 days: Implement mandatory pull request approvals, enforce code review sign-offs, and audit GitHub Actions permissions across all projects using this tool.

EUVD-2026-32638 CRITICAL

OS Command Injection (CWE-78)

2026-05-27 GitHub_M

Command Injection Sherlock

9.3

CVSS 3.1 · Vendor: GitHub_M

View

Vulnerability Assessment

Weakness

CWE

CWE-78

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization OS command sanitization, avoid shell exec

MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 27, 2026

Command injection in the Sherlock username-hunting tool's CI/CD pipeline (versions prior to 0.16.1) allows any GitHub user to run arbitrary commands on the project's GitHub Actions runner. The flaw lives in the validate_modified_targets.yml workflow, which uses the dangerous pull_request_target trigger; simply opening a pull request executes attacker-controlled code with no approval, review, or merge required. Fixed in 0.16.1; with a CVSS of 9.3 it is a high-severity supply-chain issue, though no public exploit was identified at time of analysis and the technique class is well documented.

Affected VersionsENISA

Sherlock < 0.16.1

Affected Packages

euvd sherlock fix: 0.16.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Sherlock gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 27, 2026 - 22:04 EUVD

CVE Published

May 27, 2026 - 19:23 nvd

CRITICAL 9.3

DescriptionCVE.org

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.

Executive ViewAI

Why It Matters

Sherlock's GitHub Actions workflow contains a critical command injection vulnerability (CVE-2026-44590) allowing arbitrary code execution without approval, creating direct supply-chain risk to the build pipeline. Any GitHub user can trigger the flaw by opening a pull request, completely bypassing code review and merge requirements. No public exploit identified at time of analysis, but the attack is trivial to execute.

Recommended Action

Within 24 hours: Restrict repository access or disable the validate_modified_targets.yml workflow to prevent untrusted pull requests. Within 7 days: Upgrade Sherlock to version 0.16.1 and audit CI/CD logs for suspicious execution activity. Within 30 days: Implement mandatory pull request approvals, enforce code review sign-offs, and audit GitHub Actions permissions across all projects using this tool.

Business Impact: Severe

Compensating Controls

Apply vendor patch: Sherlock 0.16.1

Threat Intelligence Overview

EPSS Score

0.8%

Top 25% exploitable

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.