How Bash Could Have Been Backdoored: One Email Address Owned GNU Savannah

Hacktron used its AI pentest tool on Savane, the PHP app that runs GNU Savannah, where Bash, Coreutils and hundreds of other GNU projects live. What came back is scary.

What they found

• Savane’s email validator accepted backticks, $ and braces, so an address like a`touch${IFS}/tmp/proof`@attacker.example passed.
• The “Test GPG keys” button dropped that email into a shell command, giving any registered user code execution.
• From there they made themselves superuser, impersonated Bash’s maintainer, and confirmed they could add an SSH key with push access to upstream Bash.
• The backend ran a 5.15 kernel still open to the 2023 GameOver(lay) OverlayFS bugs, so a public exploit gave them root and a GNU backup server.

They reported it on May 11, 2026, then found 26 confirmed bugs in total. The FSF treated it as a full compromise, patched, audited and published an incident report. The vulnerable code went live March 7, so the window was about two months.

My take

This is the xz nightmare again, caught by the good guys this time. The lessons are old school: never pass user input to a shell, and patch your kernels. It’s also a good use of AI for security: point it at the volunteer-run infrastructure we all depend on.

God Bless, and May the Source Be with You!

References & Further Reading

• Securing Internet-Critical Software: How We Could Have Backdoored Bash (Hacktron)
• How We Could Have Backdoored Bash (LWN)