What it is
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvis
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-ba
- www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox
- nvd.nist.gov/vuln/detail/CVE-2014-6278
Description and required action as published by CISA. Full record at NVD.
Other GNU entries on the list
- InetUtils GNU InetUtils Argument Injection Vulnerability CVE-2026-24061 · Jan 26, 2026
- GNU C Library GNU C Library Buffer Overflow Vulnerability CVE-2023-4911 · Nov 21, 2023
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-7169 · Jan 28, 2022
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-6271 · Jan 28, 2022