CVE-2026-44590: Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

Synopsis

Command injection in the Sherlock open-source tool (sherlock-project/sherlock) allows any GitHub user to run arbitrary commands on the CI runner by opening a pull request against the repository. The flaw lives in the validate_modified_targets.yml GitHub Actions workflow, which uses the pull_request_target trigger without guarding against untrusted input; no authentication, approval, or review step is required before the injected commands execute. Successful exploitation lets an attacker exfiltrate the GITHUB_TOKEN and make high-integrity modifications to the repository or its CI environment. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the target over the network by opening a GitHub pull request against the affected repository; no special network position is needed beyond standard internet access.

• AuthenticationNot required

  Any GitHub user can open a pull request without holding any privileged account or repository role; no credentials beyond a free GitHub account are required.

• Victim interactionNot required

  The pull_request_target workflow trigger fires automatically on pull request creation; no maintainer review, approval, or merge action is needed for the injected commands to execute.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or environmental prerequisite stands between the attacker and code execution on the CI runner.

Blast Radius

• Attacker executes arbitrary shell commands on the CI runner, enabling exfiltration of the GITHUB_TOKEN from the workflow environment.
• With the GITHUB_TOKEN in hand, the attacker can push commits, modify branches, alter release artifacts, or tamper with other workflow files in the repository.
• Partial read access to the runner environment exposes environment variables, mounted secrets, and any credentials passed into the workflow by other jobs or callers.