GNU Bash OS Command Injection Vulnerability

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Published 28 Sep 2026Updated 28 Sep 2026662 sources

CVSS 10.0 ✓ VERIFIED REFERENCE△ CISA KEV

Overview Sources History

What happened

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Affected versions

GNU Bash: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

Exploit-DB 39887Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)lastc0de2016-06-06Verified Exploit-DB 39568Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)thatchriseckert2016-03-16Verified Exploit-DB 34900Apache mod_cgi - 'Shellshock' Remote Command InjectionFederico Galatolo2014-10-06Verified Exploit-DB 36933dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)fdiskyou2014-09-29Verified Exploit-DB 34860GNU bash 4.3.11 - Environment Variable dhclient@0x00string2014-10-02Verified SploitusShellshock RCE in Bash 1.0.3-4.3 via environment variable injection.KitPloit2026-09-28T18:16:29Candidate kitploit.comShellshock RCE in Bash 1.0.3-4.3 via environment variable injection.zh2026-09-28T18:16:29Candidate SploitusRCE in GNU Bash ≤ 4.3 via crafted environment variables enabling remote shell access (Shellshock).KitPloit2026-10-04T19:07:34Candidate kitploit.comRCE in GNU Bash ≤ 4.3 via crafted environment variables enabling remote shell access (Shellshock).ru2026-10-04T19:07:34Candidate

Corrections Report an issue