{"schema_version":1,"title":"Gnu Bash vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in Gnu Bash: 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2014-6278, was published on 2 October 2025.","url":"https://junglewise.ai/threats/technologies/bash","json_url":"https://junglewise.ai/threats/technologies/bash.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/bash","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":7,"critical":3,"exploited":3,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":1},"latest":[{"cve":"CVE-2014-6278","cvss":10,"epss":0.914,"slug":"cve-2014-6278-gnu-bash-os-command-injection-via-environment-variables","title":"GNU Bash OS command injection via environment variables","severity":"critical","exploited":true,"published_at":"2025-10-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-6278-gnu-bash-os-command-injection-via-environment-variables"},{"cve":"CVE-2014-6271","cvss":9.8,"slug":"cve-2014-6271-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-01-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-6271-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability"},{"cve":"CVE-2014-7169","cvss":9.8,"slug":"cve-2014-7169-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-01-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-7169-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability"},{"cve":"CVE-2016-9401","cvss":5.5,"slug":"cve-2016-9401-gnu-bash-use-after-free-in-popd-builtin","title":"GNU Bash use-after-free in popd builtin","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:02.987+00:00","url":"https://junglewise.ai/threats/cve-2016-9401-gnu-bash-use-after-free-in-popd-builtin"},{"cve":"CVE-2016-7543","cvss":8.4,"slug":"cve-2016-7543-gnu-bash-privilege-escalation-via-shellopts-and-ps4-variables","title":"GNU Bash privilege escalation via SHELLOPTS and PS4 variables","severity":"high","exploited":false,"published_at":"2017-01-19T20:59:00.47+00:00","url":"https://junglewise.ai/threats/cve-2016-7543-gnu-bash-privilege-escalation-via-shellopts-and-ps4-variables"},{"cve":"CVE-1999-0234","cvss":4.6,"slug":"cve-1999-0234-gnu-bash-command-separator-injection-via-character-255","title":"GNU Bash command separator injection via character 255","severity":"medium","exploited":false,"published_at":"1996-10-08T04:00:00+00:00","url":"https://junglewise.ai/threats/cve-1999-0234-gnu-bash-command-separator-injection-via-character-255"},{"cve":"CVE-1999-1383","cvss":4.6,"slug":"cve-1999-1383-gnu-bash-and-tcsh-command-injection-via-directory-names","title":"GNU bash and tcsh command injection via directory names","severity":"medium","exploited":false,"published_at":"1996-09-13T04:00:00+00:00","url":"https://junglewise.ai/threats/cve-1999-1383-gnu-bash-and-tcsh-command-injection-via-directory-names"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Gnu Binutils","slug":"binutils","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/binutils"},{"name":"Gnu Glibc","slug":"glibc","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/glibc"},{"name":"GnuTLS","slug":"gnutls","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/gnutls"},{"name":"Gnu LibreDWG","slug":"libredwg","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/libredwg"},{"name":"Gnu Emacs","slug":"emacs","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/emacs"},{"name":"GNU tar","slug":"tar","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/tar"},{"name":"Gnu C Library","slug":"c-library","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/c-library"},{"name":"Gnu Wget","slug":"wget","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/wget"},{"name":"Gnu Grub2","slug":"grub2","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/grub2"},{"name":"GNU Coreutils","slug":"coreutils","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/coreutils"},{"name":"Gnu Cpio","slug":"cpio","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cpio"},{"name":"Gnu Gawk","slug":"gawk","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/gawk"}],"technology":{"hub":true,"name":"Gnu Bash","slug":"bash","vendor":{"name":"Gnu","slug":"gnu","url":"https://junglewise.ai/threats/vendors/gnu"},"aliases":["gnu-bash"],"category":"shell","homepage":"https://www.gnu.org/software/bash/","repo_url":"https://git.savannah.gnu.org/cgit/bash.git","description":"Bash is an sh-compatible shell that incorporates useful features from the Korn shell (ksh) and C shell (csh).","url":"https://junglewise.ai/threats/technologies/bash"},"most_severe":[{"cve":"CVE-2014-6278","cvss":10,"epss":0.914,"slug":"cve-2014-6278-gnu-bash-os-command-injection-via-environment-variables","title":"GNU Bash OS command injection via environment variables","severity":"critical","exploited":true,"published_at":"2025-10-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-6278-gnu-bash-os-command-injection-via-environment-variables"},{"cve":"CVE-2014-6271","cvss":9.8,"slug":"cve-2014-6271-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-01-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-6271-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability"},{"cve":"CVE-2014-7169","cvss":9.8,"slug":"cve-2014-7169-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-01-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-7169-gnu-bourne-again-shell-bash-arbitrary-code-execution-vulnerability"},{"cve":"CVE-2016-7543","cvss":8.4,"slug":"cve-2016-7543-gnu-bash-privilege-escalation-via-shellopts-and-ps4-variables","title":"GNU Bash privilege escalation via SHELLOPTS and PS4 variables","severity":"high","exploited":false,"published_at":"2017-01-19T20:59:00.47+00:00","url":"https://junglewise.ai/threats/cve-2016-7543-gnu-bash-privilege-escalation-via-shellopts-and-ps4-variables"},{"cve":"CVE-2016-9401","cvss":5.5,"slug":"cve-2016-9401-gnu-bash-use-after-free-in-popd-builtin","title":"GNU Bash use-after-free in popd builtin","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:02.987+00:00","url":"https://junglewise.ai/threats/cve-2016-9401-gnu-bash-use-after-free-in-popd-builtin"},{"cve":"CVE-1999-0234","cvss":4.6,"slug":"cve-1999-0234-gnu-bash-command-separator-injection-via-character-255","title":"GNU Bash command separator injection via character 255","severity":"medium","exploited":false,"published_at":"1996-10-08T04:00:00+00:00","url":"https://junglewise.ai/threats/cve-1999-0234-gnu-bash-command-separator-injection-via-character-255"},{"cve":"CVE-1999-1383","cvss":4.6,"slug":"cve-1999-1383-gnu-bash-and-tcsh-command-injection-via-directory-names","title":"GNU bash and tcsh command injection via directory names","severity":"medium","exploited":false,"published_at":"1996-09-13T04:00:00+00:00","url":"https://junglewise.ai/threats/cve-1999-1383-gnu-bash-and-tcsh-command-injection-via-directory-names"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}