ACTIVELY EXPLOITED
CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
| Vendor | GNU |
|---|---|
| Product | Bourne-Again Shell (Bash) |
| Actively exploited | Yes |
| Added to CISA KEV | 28 Jan 2022 |
| CISA federal deadline | 28 Jul 2022 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
SOURCES
Other GNU flaws
- CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability
- CVE-2014-6278: GNU Bash OS Command Injection Vulnerability
- CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability
- CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.