Skip to content
Threat Feed

Product

Sherlock-Project/Sherlock

1 brief RSS
critical advisory

sherlock-project/sherlock GitHub Actions RCE via pull_request_target Injection (CVE-2026-44590)

A command injection vulnerability, identified as CVE-2026-44590, exists in the `validate_modified_targets.yml` GitHub Actions workflow of sherlock-project/sherlock. A malicious pull request can trigger arbitrary command execution in the privileged CI context, allowing attackers to exfiltrate the GITHUB_TOKEN and auto-approve the malicious PR without human interaction, effectively leading to a supply chain compromise.

sherlock-project/sherlock +1 cve github_actions rce supply_chain
2r 3t 5i