Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vuln…

The Sherlock social media account hunting tool has a critical command injection vulnerability in its GitHub Actions workflow validate_modified_targets.yml prior to version 0.16.1. The vulnerability exists in the pull_request_target trigger and allows any GitHub user to execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by simply opening a pull request. No approval, review, or merge is required for exploitation. The issue has been fixed in version 0.16.1.