An email address gave code execution on GNU Savannah, home of Bash
Victoria Shinder2 min readHacktron, a security firm that uses an AI pentesting agent, published a write-up on 30 October of how it compromised GNU Savannah, the forge that hosts Bash, Coreutils and hundreds of other GNU projects. The entry point was an email address. Savane, the PHP application behind Savannah, accepted an address whose local part contained backticks and ${IFS}, and its "Test GPG keys" feature appended the account's email to a gpg command string that PHP's proc_open() handed to /bin/sh. The shell ran the payload before gpg started, as the web server user.
From there the chain was short. The web server user could read Savane's configuration, including database credentials, so the researchers set the superuser flag on their own account. Superusers can act as any user, and Hacktron says it became the account of Chet Ramey, Bash's maintainer, and confirmed it could add an SSH key that would grant push access to the upstream Bash repository. It states it added no key and did not touch the repository. The backend's kernel was still vulnerable to the 2023 OverlayFS bugs known as GameOver(lay), CVE-2023-2640 and CVE-2023-32629, which gave root, and a key found as root opened a GNU backup host.
Hacktron reported the issue to the FSF on 11 May 2026. According to the write-up, the FSF traced the vulnerable path to the Savane release of 7 March 2026, affecting both savannah.gnu.org and savannah.nongnu.org for about two months. A further audit produced 26 confirmed findings, two of them critical, which the FSF fixed and described in its own incident report.
What it means
The xz backdoor showed what one compromised link can do; this shows how little it can take to reach such a link. Nothing here was exotic: unescaped input in a shell string, database credentials readable by the web process, an unpatched kernel. What protected Bash was that the researchers stopped. For distributions the lesson is to verify what they package against signed tags rather than trusting that whoever pushed to a forge was the maintainer; for anyone running a forge, the email field is user input like any other.