How We Could Have Backdoored Bash (Hacktron blog)

Security researchers using Hacktron compromised the GNU Savannah forge and could have pushed malware into any project hosted there, including upstream Bash, by exploiting an email address such as `` `touch${IFS}/tmp/savane-rce-proof`@attacker.example `` that gave any registered user code execution on the backend. From that foothold the researchers made their account a superuser, impersonated Bash's maintainer, and confirmed they could add an SSH key with push access to the upstream Bash repository; an unpatched kernel then gave them root access and access to a GNU backup server. The researchers reported the findings to the Free Software Foundation on May 11, 2026.

How We Could Have Backdoored Bash Hacktron blog documents https://www.hacktron.ai/blog/hacking-gnu-savannah how the group was able to compromise the GNU Savannah forge and could have pushed malware into any of the projects hosted there. Using Hacktron, we found that an email address like touch${IFS}/tmp/savane-rce-proof @attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.