Description (CNA)
Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sherlock-project / sherlock | affected < 0.16.1 |
CWE
CWE-78
References
ADP enrichment
No English description supplied.