PT-2026-44083 · Isherlock · Isherlock

Astaruf · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-44590

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sherlock versions prior to 0.16.1

Description The GitHub Actions workflow 'validate modified targets.yml' is susceptible to command injection through the pull request target trigger. This allows any GitHub user to execute arbitrary commands on the CI runner and exfiltrate the GITHUB TOKEN by opening a pull request, without requiring approval, review, or merging.

Recommendations Update to version 0.16.1.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-44590

Affected Products

Isherlock

References · 3

• 🔥 https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44590 · Security Note
• https://t.me/CVEtracker/55155 · Telegram Post