Flaw in GNU's code forge could have let attackers backdoor Bash

Researchers exploited a crafted email address with backticks to gain command execution on the GNU Savannah code forge, which hosts Bash and Coreutils source code.

The flaw let them become superusers and log in as Bash maintainer Chet Ramey, though Hacktron said they did not add an SSH key or touch the repository.

The FSF patched the kernel and removed the researchers' account within three days, and a wider audit found 26 confirmed vulnerabilities, all since fixed.

Security researchers say a specially crafted but legitimate email address gave them enough control of the GNU Savannah code forge to potentially inject malicious changes into Bash, the command shell found on almost every Linux system.

Savannah is run by the Free Software Foundation (FSF) and hosts the source code for Bash and for Coreutils, the package that provides everyday commands such as ls, cp and rm, along with thousands of other GNU projects.

AI security testing firm Hacktron has detailed how its researchers registered a Savannah account with a command wrapped in backticks in their email address, which the email standard allows.

Unix style shells treat text between backticks as commands to run.

When the researchers pressed a button to test their GPG signing key, Savannah’s Savane web server software inserted the specially crafted email address into a command line without sanitisation and then executed it.

Their first test command simply created an empty file on the server to prove it had run; the researchers then swapped it for another one that opened a remote command line.

From there, the researchers said, they read the database password, made themselves superusers and logged in as Chet Ramey , Bash's longtime maintainer.

His settings page would have let them add a secure shell (SSH) key with code push rights to the Bash Git repository.

"We did not add a key and we did not touch the repository," Hacktron researchers Harsh Jaiswal and Rahul Maini said.

Furthermore, an unpatched 2023 Ubuntu kernel flaw, GameOver(lay) , then gave them root on the server, along with a key to a GNU backup host.

Hacktron reported the problem on May 11 2025, and the FSF had patched the kernel and removed the researchers' account within three days.

A wider audit of Savane turned up 26 confirmed vulnerabilities, two of them critical, with all since fixed.

In a June 2025 statement , the FSF said it had found no reason to believe sensitive project data or credentials were accessed, or that Savannah's software supply chain was compromised.

FSF said it was taking further precautionary steps, given how widely GNU software is used.

Hacktron likens the find to the 2024 xz Utils backdoor, supply chain attack, although a rogue Bash commit would not have reached users automatically.

Bash releases arrive as "tarballs" or compressed file archives digitally signed by Ramey, so any planted change would probably have had to slip past him first.

Savannah was breached in 2010 as attackers used a SQL injection flaw in Savane to deface the gnu.org page.

Hacktron said it found the flaw by pointing its artificial intelligence-assisted auditing tool at Savane’s source code.