conv.

All stories
SecurityQuiet 8d · day 11

Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash

Researchers discovered a shell injection flaw allowing any user to gain root access and push code to upstream Bash—all fixed in coordination with the FSF.

newest coverage 8d agosummary written 8d ago5 pieces16 likes & upvotes1 comments Hacker NewsMastodonLobsters

What to know

  • A shell injection flaw in Savane's email validator allowed any registered user to execute arbitrary code on GNU Savannah and escalate to root access.
  • The vulnerability existed for ~2 months (March 7 to May 11, 2026) and could have enabled attackers to push malicious code to upstream Bash, Coreutils, and other critical GNU projects used by millions of machines.
  • Hacktron discovered 26 total vulnerabilities through coordinated security audit; FSF has since fixed them all.
  • The incident highlights the security risks facing critical free software infrastructure run by volunteers with limited resources.

Hacktron Security research firmFree Software Foundation (FSF) Savannah operator and GNU project steward

Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash
security

How it unfolded 1 development · click the chart to see its coverage posts

Peak 1 piece in 3h at Oct 31, 10 AM; 5 pieces over 11 days (5 posts) Oct 31, 10 AM — 1 piece · 1 post — Hacker News 1Oct 31, 1 PM — 1 piece · 1 post — Mastodon 1Oct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — 1 piece · 1 post — Hacker News 1Nov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — 1 piece · 1 post — Lobsters 1Nov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — 1 piece · 1 post — Hacker News 1Nov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:40 PM ET
  1. 1

    Hacktron publishes technical details of Savannah exploitation

    Researchers published a detailed writeup explaining how the email validator flaw chains through Savane's GPG key testing function, allowing shell commands to execute via proc_open() and /bin/sh, and demonstrating the full exploit path to compromising the Bash repository.

    “An email address like a`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository.”
    — Hacktron
  2. background

    Hacktron identifies 26 total vulnerabilities in GNU Savannah — After the initial disclosure, Hacktron ran a comprehensive pentest across the Savane application using their security tools, uncovering 25 additional vulnerabilities beyond the shell injection flaw.

  3. background

    Hacktron reports shell injection vulnerability to FSF — Hacktron disclosed a shell injection vulnerability hidden in email addresses that grants any registered user code execution on GNU Savannah's backend. The flaw allows attackers to read database credentials, escalate to superuser, impersonate maintainers, and add SSH keys with push access to upstream repositories like Bash.

  4. background

    Savane 3.17-c369 released with email validator flaw — The vulnerable version of Savane introduced an email validator that accepts special characters including backticks and shell metacharacters in the local part of email addresses, enabling shell injection attacks.