Zero Radar
← feed
CriticalVulnerabilityupdated 2 Nov 2026, 09:47 UTC

GNU Savannah: crafted email address could run commands on server

A specially crafted email address could make the software hosting site run commands it should not run. Researchers say this could let an attacker take over the site and change code that many people use.

NewUnverified
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?UnverifiedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Registers malicious emailEmail contains shell command characters
  2. 2Address reaches backendInput is passed unsafely to a shell
  3. 3Commands executeAttacker gets code execution on the backend
  4. 4Escalates to superuserAccount is made a superuser
  5. 5Repo access possibleResearchers say an SSH key could be added to Bash
  6. ResultAttacker could tamper with Bash source

What happened

Savannah, the FSF's software forge, passes registered email addresses unsafely to a shell, enabling command injection on its backend. Researchers chained it to superuser access, impersonation of a maintainer, and an SSH key added to the upstream Bash repository.

Why it is dangerous: Any registered user could have gained code execution on the backend, and the researchers say this could have led to tampering with the Bash source repository. Users and maintainers of projects hosted on Savannah are at risk.

Are you affected?

You are affected if you use or host projects on the GNU Savannah forge (savannah.gnu.org) or run a similar web app that passes user-supplied email addresses to a shell.

GNU Savannah (savannah.gnu.org) backend; specific versions not stated in the source.

What to do

  1. Check the FSF incident report for patch status and affected versions: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
  2. If you have a Savannah account, change your password and review your account for unfamiliar SSH keys.
  3. If you run a web app that builds shell commands from user input, stop passing email addresses or other user fields directly to a shell and validate them first.

Timeline

  1. 2 Nov 2026, 09:43 UTC
    Publicly disclosed
  2. 2 Nov 2026, 09:43 UTC
    Reported by r/netsec · r/netsec
  3. 2 Nov 2026, 09:47 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Community discussion sites, treat with care

Technical details

ID
ZR-9ddc8c26
Disclosed
2 Nov 2026, 09:43 UTC
On Zero Radar
2 Nov 2026, 09:47 UTC (4 min after disclosure)
Last change
2 Nov 2026, 09:47 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GNU Savannah: crafted email address could run commands on server · Zero Radar