sherlock-project vulnerabilities and threats

CVE-2026-44590 is a critical OS command injection vulnerability in the sherlock-project's sherlock tool prior to version 0.16.1. The flaw exists in the GitHub Actions workflow validate_modified_targets.yml, which is triggered by pull_request_target events. An attacker can exploit this by opening a pull request to execute arbitrary commands on the CI runner without needing approval, review, or merge. This can lead to exfiltration of the GITHUB_TOKEN, potentially compromising repository credentials. The vulnerability is fixed in version 0.16.1.