sherlock-project vulnerabilities

Products

• sherlock 1

Latest sherlock-project CVEs

Newest publication first

1. CVE-2026-44590 Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

   Published 2026-05-27

   Critical·CVSS 9.3 EPSS 1.1%

   Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the C...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.