{"id":"CVE-2014-6271","kind":"vulnerability","aliases":["CVE-2014-6271"],"related":[],"title":"GNU Bourne-Again Shell (Bash): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","summary":"GNU Bash through 4.3 runs trailing code after function definitions in environment variable values, the Shellshock flaw. A remote attacker can execute commands on a system whose Bash reads attacker-controlled environment variables.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"GNU Bourne-Again Shell (Bash)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bash","cgi","exploited","linux","macos","runtime","self-hosted"],"not_affected_if":["no-bash-in-request-path","patched-bash"],"how_to_check":"Run: bash -c 'env x=\"() { :;}; echo VULNERABLE\" bash -c \"echo test\"' and see if VULNERABLE prints.\nCheck the Bash version with: bash --version (4.3 and earlier are affected).","fix":"Update Bash to a patched release from your OS vendor and confirm the test above no longer prints VULNERABLE.","status":"open","published_at":"2014-09-24T18:48:04+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:59+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T21:28:59Z","model":"claude-haiku-5-5","output":{"fix":"Update Bash to a patched release from your OS vendor and confirm the test above no longer prints VULNERABLE.\nunknown","reach":"internet","impact":"high","summary":"GNU Bash through 4.3 runs trailing code after function definitions in environment variable values, the Shellshock flaw. A remote attacker can execute commands on a system whose Bash reads attacker-controlled environment variables.","category":"runtime","who_cares":["bash","self-hosted","cgi","linux","macos"],"confidence":0.9,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands on the server through environment variables.","analyst_note":"","how_to_check":"Run: bash -c 'env x=\"() { :;}; echo VULNERABLE\" bash -c \"echo test\"' and see if VULNERABLE prints.\nCheck the Bash version with: bash --version (4.3 and earlier are affected).\nunknown","needs_analyst":false,"not_affected_if":["patched-bash","no-bash-in-request-path"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":2856,"output_tokens":402,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2014':18A,21A,157C '-6271':19A,22A '-7169':158C '4.3':41B,75C 'across':138C 'again':26A 'aka':145C 'allow':89C 'apach':120C 'arbitrari':13A,94C 'assign':161C 'attack':57B,68B,91C 'attacker-control':67B 'bash':6A,12A,28A,29B,39B,65B,73C,143C 'boundari':141C 'bourn':3A,9A 'bourne':25A 'bourne-again':2A,8A,24A 'cgi':30B,113C 'cgid':116C 'client':128C 'code':14A,44B,95C 'command':60B 'control':69B 'cover':163C 'craft':98C 'cve':17A,20A,156C 'definit':47B,81C 'demonstr':101C 'dhcp':127C 'environ':49B,70B,86C,99C,136C 'execut':15A,59B,93C,124C,144C 'exploit':31B 'featur':107C 'fix':150C,173C 'flaw':54B 'forcecommand':106C 'function':46B,80C 'gnu':1A,7A,23A,38B,72C 'host':37B 'http':121C 'incorrect':155C,172C 'involv':104C 'issu':153C 'linux':32B 'maco':33B 'mod':112C,115C 'modul':117C 'note':147C 'occur':137C 'openssh':109C 'origin':149C 'present':169C 'privileg':140C 'process':76C 'read':66B 'remot':56B,90C 'run':42B 'runtim':34B 'script':123C 'self':36B 'self-host':35B 'server':122C 'set':134C 'shell':5A,11A,27A 'shellshock':53B,146C 'situat':131C 'sshd':110C 'still':168C 'string':78C 'system':63B 'trail':43B,77C 'unspecifi':126C 'valu':51B,84C 'variabl':50B,71B,87C 'vector':103C 'via':96C 'vulner':16A,165C 'whose':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-09-24T18:48:04+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-6271","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6271","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2014-6271","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6271","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-6271","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6271","severity":null,"published_at":"2014-09-24T18:48:04+00:00","modified_at":"2026-06-17T00:12:48+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}