Executive brief
Sherlock is an open-source tool used to find social media accounts by username. A security flaw in its automated testing system allowed any GitHub user to execute malicious commands by simply submitting a pull request. This could have allowed an attacker to steal security tokens, bypass code review processes, and potentially compromise the project's infrastructure or website.
Technical details
The 'validate_modified_targets.yml' workflow is vulnerable to OS command injection because it uses the 'pull_request_target' trigger and interpolates untrusted JSON key names from a pull request directly into a shell command using GitHub Actions' '${{ }}' syntax. Specifically, the 'changed_targets' output is passed to a pytest command without sanitization. Because '${{ }}' is resolved before shell execution, an attacker can inject shell metacharacters into a JSON key in 'data.json' to execute arbitrary code on the CI runner. This allows for the exfiltration of the 'GITHUB_TOKEN' from the git credential helper, which can then be used to programmatically approve the attacker's own pull request or interact with the GitHub API. The issue is fixed in version 0.16.1.
Affected products
- sherlock-project Sherlock (GitHub Actions Workflow) < 0.16.1
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published by maintainers
- 2026-05-27: disclosed: CVE-2026-44590 published to NVD
- 2026-05-27: patched: Vulnerability fixed in version 0.16.1