Live › vulnerability › CVE-2014-7169
Go to dashboardGNU Bash through 4.3 executes trailing commands hidden after function definitions in environment variable values, so a remote attacker who can set an environment variable reaches code execution. This is the incomplete fix to Shellshock (CVE-2014-6271) and is listed as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GNU Bourne-Again Shell (Bash) | vendor | – | – |
x=() { :;}; echo VULNERABLE bash -c echo test (prints VULNERABLE when unpatched)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
This page as .md · .json · in your agent: get_signal("CVE-2014-7169")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.