high8.8Known exploitedPublic exploit code

CVE-2014-6278

GNU Bash OS Command Injection Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-02. Federal due date: 2025-10-23.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)2014-09-29 · remote · linux · Verified
Apache mod_cgi - 'Shellshock' Remote Command Injection2014-10-06 · remote · linux · Verified
Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)2016-06-06 · webapps · cgi
Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)2016-03-16 · remote · hardware
GNU bash 4.3.11 - Environment Variable dhclient2014-10-02 · remote · linux

Impact

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Affected products

Vendor	Product	Affected versions
Gnu	Bash	Versions 1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5

Weakness classification

CWE-78

Exploited in the wild

Public exploit code

Impact

Affected products

Weakness classification

References